high8.1
CVE-2026-119977
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due...
Impact
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| WordPress Foundation | WordPress | Versions 5.4.0 ≤5.4.24, 5.2.0 ≤5.2.29, 4.9.0 ≤4.9.34, 5.5.0 ≤5.5.23, 6.6.0 ≤6.6.10, 5.8.0 ≤5.8.18 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-p6jj-qrp3-7m4g
- https://nvd.nist.gov/vuln/detail/CVE-2026-119977
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545
- https://wordpress.org/news/2026/10/wordpress-7-1-4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve
- https://wordpress.org/news/2026/10/wordpress-7-1-4/