Remote Code Execution Vulnerability in WordPress Core by the Vendor WordPress
CVE-2026-119977

8.1HIGH

Key Information:

Vendor

WordPress
Status
WordPress
Vendor
CVE Published:
31 October 2026

What is CVE-2026-119977?

This vulnerability in WordPress Core allows unauthenticated attackers to execute arbitrary code on the server during the upgrade process. The issue arises from predictable, web-accessible staging paths that are utilized while performing full-package core upgrades. This exposure specifically affects versions 4.7 through 7.1.3, presenting significant risks for sites that fail to implement necessary security controls during WordPress upgrades.

Affected Version(s)

WordPress 4.7.0 <= 4.7.38

WordPress 4.8.0 <= 4.8.33

WordPress 4.9.0 <= 4.9.34

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp...
https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Umut Bayram
.