CVE-2026-119977

HighCVSS 8.1/10Known exploited (CISA KEV)Last modified Nov 4, 2026

Description

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
WordPress Foundation	WordPress	>= 4.7.0, <= 4.7.38; >= 4.8.0, <= 4.8.33; >= 4.9.0, <= 4.9.34; >= 5.0.0, <= 5.0.30; >= 5.1.0, <= 5.1.27; >= 5.2.0, <= 5.2.29; >= 5.3.0, <= 5.3.26; >= 5.4.0, <= 5.4.24; >= 5.5.0, <= 5.5.23; >= 5.6.0, <= 5.6.22; >= 5.7.0, <= 5.7.20; >= 5.8.0, <= 5.8.18; >= 5.9.0, <= 5.9.19; >= 6.0.0, <= 6.0.17; >= 6.1.0, <= 6.1.15; >= 6.2.0, <= 6.2.14; >= 6.3.0, <= 6.3.13; >= 6.4.0, <= 6.4.13; >= 6.5.0, <= 6.5.13; >= 6.6.0, <= 6.6.10

References

Timeline

Published: Oct 31, 2026
Last modified: Nov 4, 2026
Added to CISA KEV: Nov 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1199788.5Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted CVE-2026-1199798.8LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to CVE-2026-119987.6A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrar CVE-2026-1199806.5The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized a CVE-2026-1199887.1Numeric truncation error in Windows SMB allows an authorized attacker to execute code over a network.CVE-2026-1199898.2Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to exec CVE-2026-119997.5X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affect CVE-2026-1199909.8Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.CVE-2026-1199915.9Weak authentication in Microsoft Configuration Manager allows an unauthorized attacker to disclose information over a network.CVE-2026-1199927.0Double free in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.CVE-2026-1199936.5Access of resource using incompatible type ('type confusion') in Microsoft Office Outlook allows an unauthorized attacker to disclose inform CVE-2026-1199957.5Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.