WordPress · WordPress Core
Updated November 6, 2026
A TOCTOU race condition in the core upgrade process exposes a predictable, web‑accessible staging path. Attackers can place malicious files that are executed before the upgrade finalizes, granting remote code execution without authentication.
Compromise of the web server, defacement, data theft, or installation of ransomware on any site that performs automatic core updates.
Immediately disable automatic core upgrades; apply the patched WordPress release; restrict write access to the staging directory and monitor for unexpected files during upgrade windows.
More active vulnerabilities