WordPress released version 7.1.4 this week, patching a time-of-check to time-of-use (TOCTOU) race condition that is already under active exploitation. The vulnerability allows an authenticated attacker with Contributor-level access to upload arbitrary files during a brief window between permission validation and file write.
What a TOCTOU race condition means in practice
The classic TOCTOU pattern: a system checks a condition (is this file safe to write?) and then acts on that check (write the file). Between the check and the write, an attacker can swap in a different payload. WordPress's core file handling logic had a window measured in milliseconds, but automated exploitation tooling can win a race that short consistently.
The practical result is that an authenticated user with minimal privilege (Contributor) can write a PHP web shell to a path accessible by the web server, then execute arbitrary code as the web server user.
Who is at risk
Sites running WordPress 7.1.3 and earlier with Contributor-level accounts enabled are exposed. That includes most multi-author blogs, membership sites, and any WordPress install that allows user registration. Hosting environments that run sites for multiple customers compound the risk: a single compromised Contributor account on a shared host can pivot to neighboring sites if filesystem isolation is weak.
What to do before you patch
If immediate patching is not possible, temporarily disable user registration and demote existing Contributor accounts to Subscriber. Subscriber-level users cannot create or edit posts, removing the prerequisite for exploitation.
The durable lesson
Race conditions in web application file handling are notoriously hard to find through static analysis and easy to exploit once discovered. This is not the first TOCTOU in WordPress and will not be the last. Treat WordPress updates as security-critical within 24 hours of release, the same as you would treat an OS kernel patch.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your WordPress estate needs a security review or update prioritization help.