VDB
CVE-2026-119977
CVE-2026-119977
PUBLISHED
CVSS 8.1 HIGH
Reported by wordfence · Published October 31, 2026
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| WordPress | WordPress Foundation | 7.1.3, 7.0.7, 6.9.10, 6.8.11, 6.7.10, 6.6.10, 6.5.13, 6.4.13, 6.3.13, 6.2.14, 6.1.15, 6.0.17, 5.9.19, 5.8.18, 5.7.20, 5.6.22, 5.5.23, 5.4.24, 5.3.26, 5.2.29, 5.1.27, 5.0.30, 4.9.34, 4.8.33, 4.7.38 |
| wordpress | wordpress | 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18, 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28, 5.0.31, 4.9.35, 4.8.34, 4.7.39 |
Risk scores
CVSS 3.1
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| WordPress Foundation | WordPress | 4.7.0, 4.8.0, 4.9.0 |
| WordPress Foundation | WordPress | 4.7.0, 4.8.0, 4.9.0 |
Timeline
- Oct 31, 2026 EPSS Score (3 in total, the first dated here)
- Oct 31, 2026 CVE Published
- Nov 3, 2026 CISA KEV Added
- Nov 3, 2026 VulnCheck KEV Exploitation
- Nov 4, 2026 VulnCheck XDB Entry (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-119977
vulnetix vdb fixes CVE-2026-119977Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-119977/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart