GCVE-110-NCSC-2026-466

Advisory PublishedCVSS 8.1/10

Vulnetix · Advisory published November 4, 2026

WordPress Core versions 4.7 through 7.1.3 contain a TOCTOU race condition vulnerability involving predictable, web-accessible staging paths during core upgrades, enabling unauthenticated remote code execution within a limited upgrade window.

Download JSON Look up in the Resolve Platform

Weaknesses (CWE)

CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition

Risk Scores

CVSS 3.1

8.1/10

High · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
WordPress	vers:unknown/*	—	—

Aliases

CVE-2026-119977

References

advisory

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Look up in the Resolve Platform Download JSON