CVE-2026-119977
Received Received - Intake

Remote Code Execution in WordPress Core

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-119977
EUVD
EUVD-2026-114575

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

WordPress Core versions 4.7 through 7.1.3 are vulnerable to Remote Code Execution due to predictable staging paths used during core upgrades. Unauthenticated attackers can exploit this during the upgrade window to execute code on the server.

Detection Guidance

Check WordPress version via dashboard or run command: wp core version. Inspect upgrade logs for suspicious staging paths or unexpected file modifications during updates.

Impact Analysis

An attacker could gain full control of your WordPress site, allowing them to steal data, deface content, install malware, or use the server for further attacks. This could lead to data breaches, service disruption, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, fines, and reputational damage due to non-compliance.

Mitigation Strategies

Update WordPress to version 7.1.4 immediately using the dashboard or run: wp core update. Disable automatic updates temporarily if staging paths are exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119977. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart