CVE-2026-119977 — 脆弱性インテリジェンス

wordpress — wordpress

公表日: 2026-10-31T05:33:07.059Z

CVSS

8.1

CISA KEV

既知の悪用を確認

情報源の原文（翻訳ではありません）

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

情報源

• CVE-2026-119977
• Product
• Product
• Product
• Product
• Patch
• Patch
• Release Notes
• Third Party Advisory
• CVE-2026-119977
• WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
• Original advisory
• Third Party Advisory
• Original advisory
• Original advisory
• US Government Resource