CVE-2026-119977 WordPress Foundation WordPress
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the…
- CVSS
- 8.1 High
- EPSS
- 1.2%
- Percentile
- 69
- Published
- 2026-10-31
- Force
- 9 of 12
- Public PoC
- 9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
On CISA’s exploited list
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
- Added
- 2026-11-03
- Federal patch deadline
- 2026-11-06
- Ransomware use
- not known