CVE-2026-119977

HIGH 8.1

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

CWE	CWE-367
Vendor	wordpress foundation
Product	wordpress
Ecosystems	PHP CMS
Industries	WebMedia
Published	Oct 31, 2026

Stay Ahead of the Next One

Get instant alerts for wordpress foundation wordpress

Be the first to know when new high vulnerabilities affecting wordpress foundation wordpress are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

WordPress Foundation / WordPress

4.7.0 ≤ 4.7.38 4.8.0 ≤ 4.8.33 4.9.0 ≤ 4.9.34 5.0.0 ≤ 5.0.30 5.1.0 ≤ 5.1.27 5.2.0 ≤ 5.2.29 5.3.0 ≤ 5.3.26 5.4.0 ≤ 5.4.24 5.5.0 ≤ 5.5.23 5.6.0 ≤ 5.6.22 5.7.0 ≤ 5.7.20 5.8.0 ≤ 5.8.18 5.9.0 ≤ 5.9.19 6.0.0 ≤ 6.0.17 6.1.0 ≤ 6.1.15 6.2.0 ≤ 6.2.14 6.3.0 ≤ 6.3.13 6.4.0 ≤ 6.4.13 6.5.0 ≤ 6.5.13 6.6.0 ≤ 6.6.10 6.7.0 ≤ 6.7.10 6.8.0 ≤ 6.8.11 6.9.0 ≤ 6.9.10 7.0.0 ≤ 7.0.7 7.1.0 ≤ 7.1.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

Credits

Umut Bayram