CVE-2026-119977

WordPress · Published October 31, 2026

8.1

CVSS v3.1

HIGH

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Affected Products

Wordpress < 4.7.39
Wordpress < 4.8.34
Wordpress < 4.9.35
Wordpress < 5.0.31

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H