High 8.1

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due...

CVE-2026-119977 First seen on SecPulse 14:33

Affected packages

Ecosystem	Package	Affected	Fixed
WordPress Foundation	WordPress	4.7.0 – 4.7.38 4.8.0 – 4.8.33 4.9.0 – 4.9.34 5.0.0 – 5.0.30 5.1.0 – 5.1.27 5.2.0 – 5.2.29 +19 more	— — — — — —

Original description The description as published by the source.

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: High 8.1; CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Oct 31, 2026
First seen on SecPulse: 14:33
GHSA: GHSA-p6jj-qrp3-7m4g
CWE: CWE-367

NVD GitHub Advisory

Tags(click for explanation)

Web Frameworks

WordPress

Attack Types

Remote Code Execution

CWE

CWE-367

All

Wordpress Foundation

Detection sources

NIST National Vulnerability Database15:16
GitHub Security Advisories (Global)15:30
CVE.org (CVE Program・cvelistV5)14:33