WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
CVE-2026-119977
CVSS base score
8.1 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-367
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
wordpress wordpress
References
- core.trac.wordpress.org Product
- core.trac.wordpress.org Product
- core.trac.wordpress.org Product
- core.trac.wordpress.org Product
- core.trac.wordpress.org Patch
- core.trac.wordpress.org Patch
- wordpress.org Release Notes
- www.wordfence.com Third Party Advisory
- www.cisa.gov US Government Resource
- www.wordfence.com Third Party Advisory