Investigation and Countermeasures for TOCTOU Race Condition Vulnerabilities in WordPress Plugins with Execution Limits

WordPress is the most popular content management system in the world. It is an open-source software that supports a wide range of plugins. However, since these plugins are developed and released by anyone, they may have security problems. Web applications need to be designed and developed in consideration of possible race conditions that may occur when multiple processes access shared resources at the same time, but race conditions aren't given much attention by developers and may result in vulnerability. This vulnerability is known to cause problems such as un-authorized data access, database inconsistency, and file content corruption by an attacker who intentionally creates a race condition. It is also considered that this vulnerability is not as well-known as Cross Site Scripting and SQL injection. In this paper, we investigate the race condition vulnerabilities in WordPress plugins. Based on the results of this survey, we discuss the trends and causes of these vulnerabilities, as well as countermeasures for them.