Skip to content
fr Sign in
8.1 High Exploited

CVE-2026-119977 WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

Active exploitation observed

· CISA KEV catalogue
Required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware campaigns Not observed so far
Weakness CWE-367

Description

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
High
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected products and versions

Product Affected versions Fixed in
WordPress 7.1 7.1.0 → 7.1.3 No fix stated
WordPress 7.0 7.0.0 → 7.0.7 No fix stated
WordPress 6.9 6.9.0 → 6.9.10 No fix stated
WordPress 6.8 6.8.0 → 6.8.11 No fix stated
WordPress 6.7 6.7.0 → 6.7.10 No fix stated
WordPress 6.6 6.6.0 → 6.6.10 No fix stated
WordPress 6.5 6.5.0 → 6.5.13 No fix stated
WordPress 6.4 6.4.0 → 6.4.13 No fix stated
WordPress 6.3 6.3.0 → 6.3.13 No fix stated
Show the 16 other branches
Product Affected versions Fixed in
WordPress 6.2 6.2.0 → 6.2.14 No fix stated
WordPress 6.1 6.1.0 → 6.1.15 No fix stated
WordPress 6.0 6.0.0 → 6.0.17 No fix stated
WordPress 5.9 5.9.0 → 5.9.19 No fix stated
WordPress 5.8 5.8.0 → 5.8.18 No fix stated
WordPress 5.7 5.7.0 → 5.7.20 No fix stated
WordPress 5.6 5.6.0 → 5.6.22 No fix stated
WordPress 5.5 5.5.0 → 5.5.23 No fix stated
WordPress 5.4 5.4.0 → 5.4.24 No fix stated
WordPress 5.3 5.3.0 → 5.3.26 No fix stated
WordPress 5.2 5.2.0 → 5.2.29 No fix stated
WordPress 5.1 5.1.0 → 5.1.27 No fix stated
WordPress 5.0 5.0.0 → 5.0.30 No fix stated
WordPress 4.9 4.9.0 → 4.9.34 No fix stated
WordPress 4.8 4.8.0 → 4.8.33 No fix stated
WordPress 4.7 4.7.0 → 4.7.38 No fix stated

References

Timeline

  1. Published
  2. Added to the KEV catalogue
  3. Last modified

Other CVEs of WordPress

The 8 CVEs of WordPress →
CVE-2026-114570 WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2… 4.9 Medium CVE-2026-3906 WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1 4.3 Medium CVE-2022-4973 WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be… 4.9 Medium CVE-2024-6307 WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to… 6.4 Medium
Track this CVE