Remote Code Execution vulnerability in WordPress

WordPress

What happened

A vulnerability has been discovered in WordPress Core that could allow unauthorized remote code execution during core upgrades. This is due to predictable staging paths accessible over the web.

Are you affected?

WordPress users running versions 4.7 through 7.1.3 may be affected by this issue.

What to do now

1. Upgrade to the latest version of WordPress to ensure you are no longer vulnerable.
2. Review your update processes to mitigate potential risks during core upgrades.
3. Monitor security advisories from WordPress for updates on this issue.

Sources

• cve.now/CVE-2026-119977
• cve.now/GHSA-P6JJ-QRP3-7M4G
• CVE-2026-119977
• GHSA-P6JJ-QRP3-7M4G
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve
• https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378
• https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162
• https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549
• https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282
• https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346
• https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545
• https://wordpress.org/news/2026/10/wordpress-7-1-4/
• https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977
• https://github.com/foxcornlab/wordpress-core-scanner

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.