CVEs / CVE-2026-119977
CVE-2026-119977: WordPress Foundation WordPress vulnerability
- high 8.1 CVSS 3.1 (from the CNA)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2026-119977
Description
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| WordPress Foundation WordPress | from 4.7.0, up to and including 4.7.38 | — |
| WordPress Foundation WordPress | from 4.8.0, up to and including 4.8.33 | — |
| WordPress Foundation WordPress | from 4.9.0, up to and including 4.9.34 | — |
| WordPress Foundation WordPress | from 5.0.0, up to and including 5.0.30 | — |
| WordPress Foundation WordPress | from 5.1.0, up to and including 5.1.27 | — |
| WordPress Foundation WordPress | from 5.2.0, up to and including 5.2.29 | — |
| WordPress Foundation WordPress | from 5.3.0, up to and including 5.3.26 | — |
| WordPress Foundation WordPress | from 5.4.0, up to and including 5.4.24 | — |
| WordPress Foundation WordPress | from 5.5.0, up to and including 5.5.23 | — |
| WordPress Foundation WordPress | from 5.6.0, up to and including 5.6.22 | — |
| WordPress Foundation WordPress | from 5.7.0, up to and including 5.7.20 | — |
| WordPress Foundation WordPress | from 5.8.0, up to and including 5.8.18 | — |
| WordPress Foundation WordPress | from 5.9.0, up to and including 5.9.19 | — |
| WordPress Foundation WordPress | from 6.0.0, up to and including 6.0.17 | — |
| WordPress Foundation WordPress | from 6.1.0, up to and including 6.1.15 | — |
| WordPress Foundation WordPress | from 6.2.0, up to and including 6.2.14 | — |
| WordPress Foundation WordPress | from 6.3.0, up to and including 6.3.13 | — |
| WordPress Foundation WordPress | from 6.4.0, up to and including 6.4.13 | — |
| WordPress Foundation WordPress | from 6.5.0, up to and including 6.5.13 | — |
| WordPress Foundation WordPress | from 6.6.0, up to and including 6.6.10 | — |
| WordPress Foundation WordPress | from 6.7.0, up to and including 6.7.10 | — |
| WordPress Foundation WordPress | from 6.8.0, up to and including 6.8.11 | — |
| WordPress Foundation WordPress | from 6.9.0, up to and including 6.9.10 | — |
| WordPress Foundation WordPress | from 7.0.0, up to and including 7.0.7 | — |
| WordPress Foundation WordPress | from 7.1.0, up to and including 7.1.3 | — |
Exploitation
Not in the CISA Known Exploited Vulnerabilities catalog as of 30 Oct 2026.
Severity
| CVSS 3.1 | 8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HScored by the CNA ([email protected]) |
|---|---|
| Weakness | CWE-367 |
On the Stackurity blog
References
- CVE-2026-119977 on NVD
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545
- https://wordpress.org/news/2026/10/wordpress-7-1-4/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.