CVE-2026-119977High· 8.1▾ Abyssal⚠ Exploited in the wildPoC availableWordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 44.6 · likelihood 0.2 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Federal remediation due Nov 6, 2026
Last analysed / modified upstream
1.0%
3 GitHub repos (last check)
Added to the CISA catalog on Nov 3, 2026. Federal remediation due Nov 6, 2026. View catalog ↗
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
WordPress >= 4.7.0 <= 4.7.38WordPress >= 4.8.0 <= 4.8.33WordPress >= 4.9.0 <= 4.9.34WordPress >= 5.0.0 <= 5.0.30WordPress >= 5.1.0 <= 5.1.27WordPress >= 5.2.0 <= 5.2.29WordPress >= 5.3.0 <= 5.3.26WordPress >= 5.4.0 <= 5.4.24WordPress >= 5.5.0 <= 5.5.23WordPress >= 5.6.0 <= 5.6.22WordPress >= 5.7.0 <= 5.7.20WordPress >= 5.8.0 <= 5.8.18WordPress >= 5.9.0 <= 5.9.19WordPress >= 6.0.0 <= 6.0.17WordPress >= 6.1.0 <= 6.1.15WordPress >= 6.2.0 <= 6.2.14WordPress >= 6.3.0 <= 6.3.13WordPress >= 6.4.0 <= 6.4.13WordPress >= 6.5.0 <= 6.5.13WordPress >= 6.6.0 <= 6.6.10WordPress >= 6.7.0 <= 6.7.10WordPress >= 6.8.0 <= 6.8.11WordPress >= 6.9.0 <= 6.9.10WordPress >= 7.0.0 <= 7.0.7WordPress >= 7.1.0 <= 7.1.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-87902High· 8.1An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories
CVE-2026-63030Critical· 9.8WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL In…
CVE-2026-60137Medium· 5.9WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
CVE-2011-4899High· 7.5wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbh…
CVE-2026-93485High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.
CVE-2024-30088High· 7.0Windows Kernel Elevation of Privilege Vulnerability