toctou race condition

CISA KEV: WordPress Core Upgrade Race Under Active Attack

CVE-2026-119977 lets unauthenticated attackers hijack WordPress updates via predictable, web-accessible staging paths; patching is the exposure window.