CVE-2026-119977
HIGH
MEDIUM
Priority: 0.05
BB Relevance:
66/100
Published: 2026-10-31
Modified: 2026-10-31
First seen: 2026-10-31
Status: active
Attack Surface
Network
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Weakness Classification (1)
Affected Software (25)
| Vendor | Product | Version |
|---|---|---|
| WordPress Foundation | WordPress | 4.7.0 |
| WordPress Foundation | WordPress | 4.8.0 |
| WordPress Foundation | WordPress | 4.9.0 |
| WordPress Foundation | WordPress | 5.0.0 |
| WordPress Foundation | WordPress | 5.1.0 |
| WordPress Foundation | WordPress | 5.2.0 |
| WordPress Foundation | WordPress | 5.3.0 |
| WordPress Foundation | WordPress | 5.4.0 |
| WordPress Foundation | WordPress | 5.5.0 |
| WordPress Foundation | WordPress | 5.6.0 |
| WordPress Foundation | WordPress | 5.7.0 |
| WordPress Foundation | WordPress | 5.8.0 |
| WordPress Foundation | WordPress | 5.9.0 |
| WordPress Foundation | WordPress | 6.0.0 |
| WordPress Foundation | WordPress | 6.1.0 |
| WordPress Foundation | WordPress | 6.2.0 |
| WordPress Foundation | WordPress | 6.3.0 |
| WordPress Foundation | WordPress | 6.4.0 |
| WordPress Foundation | WordPress | 6.5.0 |
| WordPress Foundation | WordPress | 6.6.0 |
| WordPress Foundation | WordPress | 6.7.0 |
| WordPress Foundation | WordPress | 6.8.0 |
| WordPress Foundation | WordPress | 6.9.0 |
| WordPress Foundation | WordPress | 7.0.0 |
| WordPress Foundation | WordPress | 7.1.0 |