Live › vulnerability › CVE-2026-119977
WordPress Core versions 4.7 through 7.1.3 use predictable, web-accessible staging paths during full-package core upgrades. An unauthenticated attacker can use those paths to execute code on the server while an upgrade is in progress.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Self-hosted WordPress sites on core 4.7 through 7.1.3 that have not applied the 7.1.4 (or branch backport) security update. Exposure is only during a full-package core update, when the staging folder under wp-content/upgrade may be reachable and run PHP; this includes automatic background updates. Managed hosts that patched, and sites already on a fixed release, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WordPress | wordpress | >= 4.7, <= 7.1.3 | 7.1.4 |
7.1.4 (Dashboard > Updates)ship as they become ready; check Dashboard > Updates for your branch's release7.0.8, 6.9.11, 6.8.12 ... 4.7.39; not confirmed on the vendor pageEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
This page as .md · .json · in your agent: get_signal("CVE-2026-119977")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.