WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
Summary
| CVE | CVE-2026-119977 |
|---|---|
| State | PUBLISHED |
| Assigner | Wordfence |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-31 06:16:34 UTC |
| Updated | 2026-10-31 06:16:34 UTC |
| Description | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. |
Risk And Classification
Primary CVSS: v3.1 8.1 HIGH from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-367 | CWE-367 CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | WordPress Foundation | WordPress | affected 4.7.0 4.7.38 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 4.8.0 4.8.33 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 4.9.0 4.9.34 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 5.0.0 5.0.30 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 5.1.0 5.1.27 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 5.2.0 5.2.29 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 5.3.0 5.3.26 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 5.4.0 5.4.24 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 5.5.0 5.5.23 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 5.6.0 5.6.22 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 5.7.0 5.7.20 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 5.8.0 5.8.18 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 5.9.0 5.9.19 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 6.0.0 6.0.17 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 6.1.0 6.1.15 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 6.2.0 6.2.14 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 6.3.0 6.3.13 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 6.4.0 6.4.13 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 6.5.0 6.5.13 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 6.6.0 6.6.10 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 6.7.0 6.7.10 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 6.8.0 6.8.11 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 6.9.0 6.9.10 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 7.0.0 7.0.7 semver | Not specified |
| CNA | WordPress Foundation | WordPress | affected 7.1.0 7.1.3 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php | [email protected] | core.trac.wordpress.org | |
| core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php | [email protected] | core.trac.wordpress.org | |
| core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php | [email protected] | core.trac.wordpress.org | |
| core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php | [email protected] | core.trac.wordpress.org | |
| wordpress.org/news/2026/10/wordpress-7-1-4 | [email protected] | wordpress.org | |
| www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc... | [email protected] | www.wordfence.com | |
| core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php | [email protected] | core.trac.wordpress.org | |
| core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php | [email protected] | core.trac.wordpress.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Umut Bayram (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-10-28T00:00:00.000Z | Disclosed |
There are currently no legacy QID mappings associated with this CVE.