CVE-2026-119977

VendorwordpressProductwordpressDiscoveredOct 31, 2026UpdatedNov 4, 2026

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

View graph Watch Export

CVSS v3.1

8.1 HIGH

EPSS

1.16%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Nov 1, 2026 → Nov 6, 2026

▲ 0.56pp

0.60% → 1.16% over 3 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityHIGH

Privileges RequiredNONE

User InteractionNONE

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Connections

8 relationships

CWE-367

source

Timeline

disclosure → media coverage

Oct 31, 2026

Disclosure — published as a CVE record. · last revised by NVD Nov 4, 2026

Nov 4, 2026

thehackernews.com reports: CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

Nov 4, 2026

advisories.ncsc.nl reports: NCSC-2026-0466 [1.00] [L/H] Kwetsbaarheid verholpen in WordPress Core

Nov 4, 2026

bleepingcomputer.com reports: CISA flags WordPress RCE flaw as actively exploited in attacks

Nov 4, 2026

acn.gov.it reports: WordPress: rilevato sfruttamento in rete della CVE-2026-119977

Public PoC (4)

github.com/foxcornlab/wordpress-core-scanner github.com/lysophavin18/CVE-2026-119977 github.com/Worthes/CVE-2026-119977-WordPress-Upgrade-RCE-Bypasses-7.1.4 github.com/tc4dy/CVE-2026-119977-Toolkit

Unverified third-party code — review before executing.