Vulnerability Description
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-c
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-w
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-w
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-
- https://wordpress.org/news/2026/10/wordpress-7-1-4/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e
FAQ
What is CVE-2026-119977?
CVE-2026-119977 is a vulnerability with a CVSS score of 8.1 (HIGH). WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it poss...
How severe is CVE-2026-119977?
CVE-2026-119977 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119977?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.