CVE-2026-119977 — Vulnerability intelligence

wordpress — wordpress

Published: 2026-10-31T05:33:07.059Z

CVSS

8.1

CISA KEV

Known exploitation

Original source text (not a translation)

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Sources

• CVE-2026-119977
• Product
• Product
• Product
• Product
• Patch
• Patch
• Release Notes
• Third Party Advisory
• CVE-2026-119977
• WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
• Original advisory
• Third Party Advisory
• Original advisory
• Original advisory
• US Government Resource