{"id":"CVE-2026-119977","title":"WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution","summary":"WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-367"],"vendor":"WordPress Foundation","product":"WordPress","affected":["WordPress >= 4.7.0 <= 4.7.38","WordPress >= 4.8.0 <= 4.8.33","WordPress >= 4.9.0 <= 4.9.34","WordPress >= 5.0.0 <= 5.0.30","WordPress >= 5.1.0 <= 5.1.27","WordPress >= 5.2.0 <= 5.2.29","WordPress >= 5.3.0 <= 5.3.26","WordPress >= 5.4.0 <= 5.4.24","WordPress >= 5.5.0 <= 5.5.23","WordPress >= 5.6.0 <= 5.6.22","WordPress >= 5.7.0 <= 5.7.20","WordPress >= 5.8.0 <= 5.8.18","WordPress >= 5.9.0 <= 5.9.19","WordPress >= 6.0.0 <= 6.0.17","WordPress >= 6.1.0 <= 6.1.15","WordPress >= 6.2.0 <= 6.2.14","WordPress >= 6.3.0 <= 6.3.13","WordPress >= 6.4.0 <= 6.4.13","WordPress >= 6.5.0 <= 6.5.13","WordPress >= 6.6.0 <= 6.6.10","WordPress >= 6.7.0 <= 6.7.10","WordPress >= 6.8.0 <= 6.8.11","WordPress >= 6.9.0 <= 6.9.10","WordPress >= 7.0.0 <= 7.0.7","WordPress >= 7.1.0 <= 7.1.3"],"ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total","timestamp":"2026-11-03T00:00:00+00:00"},"exploited":true,"exploitAvailable":true,"published":"2026-10-31","updated":"2026-11-04","sourceUpdated":"2026-11-04T04:56:31.158Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119977","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545"},{"url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/"}],"tags":["cve.org","in-the-wild","exploit-available","kev"],"epss":0.0102,"epssPercentile":0.63514,"kev":true,"kevDateAdded":"2026-11-03","kevDueDate":"2026-11-06","kevRansomware":false,"exploits":{"github":3,"githubRepos":["https://github.com/Worthes/CVE-2026-119977-WordPress-Upgrade-RCE-Bypasses-7.1.4","https://github.com/lysophavin18/CVE-2026-119977","https://github.com/tc4dy/CVE-2026-119977-Toolkit"],"checkedAt":"2026-11-05T20:33:42.479Z"},"ingestedAt":"2026-11-05T20:33:06.678Z","slug":"CVE-2026-119977","body":"## Overview\n\nWordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.\n\n## Affected\n\n- `WordPress >= 4.7.0 <= 4.7.38`\n- `WordPress >= 4.8.0 <= 4.8.33`\n- `WordPress >= 4.9.0 <= 4.9.34`\n- `WordPress >= 5.0.0 <= 5.0.30`\n- `WordPress >= 5.1.0 <= 5.1.27`\n- `WordPress >= 5.2.0 <= 5.2.29`\n- `WordPress >= 5.3.0 <= 5.3.26`\n- `WordPress >= 5.4.0 <= 5.4.24`\n- `WordPress >= 5.5.0 <= 5.5.23`\n- `WordPress >= 5.6.0 <= 5.6.22`\n- `WordPress >= 5.7.0 <= 5.7.20`\n- `WordPress >= 5.8.0 <= 5.8.18`\n- `WordPress >= 5.9.0 <= 5.9.19`\n- `WordPress >= 6.0.0 <= 6.0.17`\n- `WordPress >= 6.1.0 <= 6.1.15`\n- `WordPress >= 6.2.0 <= 6.2.14`\n- `WordPress >= 6.3.0 <= 6.3.13`\n- `WordPress >= 6.4.0 <= 6.4.13`\n- `WordPress >= 6.5.0 <= 6.5.13`\n- `WordPress >= 6.6.0 <= 6.6.10`\n- `WordPress >= 6.7.0 <= 6.7.10`\n- `WordPress >= 6.8.0 <= 6.8.11`\n- `WordPress >= 6.9.0 <= 6.9.10`\n- `WordPress >= 7.0.0 <= 7.0.7`\n- `WordPress >= 7.1.0 <= 7.1.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":44.6,"likelihood":0.2,"exploitation":25,"ransomware":0},"changes":[]}