CVE-2026-119977

HighCVSS 8.1

Published: 31/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 31/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.60%

49th percentile - higher than 49% of all known CVEs

Summary

WordPress Core versions 4.7 through 7.1.3 are vulnerable to Remote Code Execution due to predictable, web-accessible staging paths used during full-package core upgrades. This allows unauthenticated attackers to execute code on the server during the upgrade window.

Risk Assessment

An attacker could take control of the WordPress server, leading to full site compromise and potential data leakage. The risk is high because exploitation requires no authentication and only the presence of an upgrade window.

Recommendation

Update WordPress Core to a version later than 7.1.3 as soon as possible and restrict access to staging directories during upgrades. Consider performing upgrades in a controlled maintenance window and monitor for unusual files in the web root.

Other vulnerabilities in WordPress Core

CVE-2026-114570Medium
WordPress Core (all versions up to and including 7.0.2) is vulnerable to stored Cross-Site Scripting via Quick Edit due to insufficient escaping of user display names. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a higher-privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

Original NVD description (English source)

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS