{"affected":[{"defaultStatus":"unaffected","product":"WordPress","source":"CNA: Wordfence","vendor":"WordPress Foundation","versions":[{"lessThanOrEqual":"4.7.38","status":"affected","version":"4.7.0","versionType":"semver"},{"lessThanOrEqual":"4.8.33","status":"affected","version":"4.8.0","versionType":"semver"},{"lessThanOrEqual":"4.9.34","status":"affected","version":"4.9.0","versionType":"semver"},{"lessThanOrEqual":"5.0.30","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThanOrEqual":"5.1.27","status":"affected","version":"5.1.0","versionType":"semver"},{"lessThanOrEqual":"5.2.29","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThanOrEqual":"5.3.26","status":"affected","version":"5.3.0","versionType":"semver"},{"lessThanOrEqual":"5.4.24","status":"affected","version":"5.4.0","versionType":"semver"},{"lessThanOrEqual":"5.5.23","status":"affected","version":"5.5.0","versionType":"semver"},{"lessThanOrEqual":"5.6.22","status":"affected","version":"5.6.0","versionType":"semver"},{"lessThanOrEqual":"5.7.20","status":"affected","version":"5.7.0","versionType":"semver"},{"lessThanOrEqual":"5.8.18","status":"affected","version":"5.8.0","versionType":"semver"},{"lessThanOrEqual":"5.9.19","status":"affected","version":"5.9.0","versionType":"semver"},{"lessThanOrEqual":"6.0.17","status":"affected","version":"6.0.0","versionType":"semver"},{"lessThanOrEqual":"6.1.15","status":"affected","version":"6.1.0","versionType":"semver"},{"lessThanOrEqual":"6.2.14","status":"affected","version":"6.2.0","versionType":"semver"},{"lessThanOrEqual":"6.3.13","status":"affected","version":"6.3.0","versionType":"semver"},{"lessThanOrEqual":"6.4.13","status":"affected","version":"6.4.0","versionType":"semver"},{"lessThanOrEqual":"6.5.13","status":"affected","version":"6.5.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"},{"lessThanOrEqual":"6.7.10","status":"affected","version":"6.7.0","versionType":"semver"},{"lessThanOrEqual":"6.8.11","status":"affected","version":"6.8.0","versionType":"semver"},{"lessThanOrEqual":"6.9.10","status":"affected","version":"6.9.0","versionType":"semver"},{"lessThanOrEqual":"7.0.7","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThanOrEqual":"7.1.3","status":"affected","version":"7.1.0","versionType":"semver"}]}],"cveId":"CVE-2026-119977","cwes":["CWE-367"],"description":"WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.","epss":{"date":"2026-11-03","percentile":0.48751,"score":0.006},"exploits":[],"kev":null,"metrics":[{"score":8.1,"severity":"high","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":8.1,"severity":"high","source":"NVD: security@wordfence.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793739503478,"publishedAt":1793424787059,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378"},{"source":"CNA: Wordfence","tags":[],"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162"},{"source":"CNA: Wordfence","tags":[],"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549"},{"source":"CNA: Wordfence","tags":[],"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282"},{"source":"CNA: Wordfence","tags":[],"url":"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346"},{"source":"CNA: Wordfence","tags":[],"url":"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545"},{"source":"CNA: Wordfence","tags":[],"url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/"},{"source":"ADP: CISA-ADP","tags":["third-party-advisory"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution"},{"source":"ADP: CISA-ADP","tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977"},{"source":"security@wordfence.com","tags":[],"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162"},{"source":"security@wordfence.com","tags":[],"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378"},{"source":"security@wordfence.com","tags":[],"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549"},{"source":"security@wordfence.com","tags":[],"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282"},{"source":"security@wordfence.com","tags":[],"url":"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346"},{"source":"security@wordfence.com","tags":[],"url":"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545"},{"source":"security@wordfence.com","tags":[],"url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/"},{"source":"security@wordfence.com","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve"}],"remediation":[],"revision":"be925af7f355ac6417a53bf478741ff44647eb92fca224eed64d208c50eed26a","sources":[{"modifiedAt":1793739503478,"name":"CNA: Wordfence","retrievedAt":1793740196808,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119977"},{"modifiedAt":1793636359997,"name":"NVD","retrievedAt":1793643480835,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119977"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793740237748,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-119977"}],"ssvc":{"assessedAt":1793739005434,"automatable":"no","exploitation":"active","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution","updatedAt":1793740237748}