{"id":"CVE-2026-119977","kind":"vulnerability","aliases":["CVE-2026-119977"],"related":[],"title":"WordPress Core: predictable upgrade paths let attackers run code on the server","description":"WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.","summary":"WordPress Core versions 4.7 through 7.1.3 use predictable, web-accessible staging paths during full-package core upgrades. An unauthenticated attacker can use those paths to execute code on the server while an upgrade is in progress.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WordPress","fixed":["7.1.4"],"affected":">= 4.7, <= 7.1.3","ecosystem":"wordpress"}],"ecosystems":[],"tags":["php","race-condition","rce","runtime","self-hosted","wordpress"],"not_affected_if":["managed-hosting","patched-version","upgrade-dir-not-web-accessible","version-outside-range"],"how_to_check":"- Run 'wp core version' or open Dashboard > Updates. Versions 4.7 through 7.1.3 without the security update for your branch are affected.\n- Look in your web logs for requests to wp-content/upgrade/ paths (especially setup-config.php) and check for unexpected wp-config.php changes, new admin users, plugins or PHP files.\n- Exposure needs: full-package core update in progress, wp-content/upgrade reachable over the web with PHP execution.","fix":"Update to WordPress 7.1.4 (Dashboard > Updates). For older branches WordPress says the fix is backported to all branches still eligible for security fixes (back to 4.7) and backports 'ship as they become ready'; check Dashboard > Updates for your branch's release. Secondary reports list 7.0.8, 6.9.11, 6.8.12 ... 4.7.39; not confirmed on the vendor page. Fix per reports: randomized staging directory names, an index guard, no unsafe promotion of staged config.","status":"open","published_at":"2026-10-31T06:16:34+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","triaged_at":"2026-10-31T06:34:13+00:00","updated_at":"2026-10-31T06:36:04+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-31T06:34:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Core: predictable upgrade paths let attackers run code on the server","impact":"high","summary":"WordPress Core versions 4.7 through 7.1.3 use predictable, web-accessible staging paths during full-package core upgrades. An unauthenticated attacker can use those paths to execute code on the server while an upgrade is in progress.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","self-hosted","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker executes code on the web server","analyst_note":"Confirm the exact staging paths, the fixed WordPress version, and whether the flaw depends on upgrade timing, using the NVD entry and WordPress security release notes.","how_to_check":"- Check the installed WordPress version in the admin dashboard footer or with `wp core version` if WP-CLI is available.\n- Confirm whether the installed version falls in the range 4.7 through 7.1.3.\n- Look for web-accessible upgrade staging directories on the server during or after core upgrades (the sources do not name the exact paths).","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"WordPress sites running core versions 4.7 through 7.1.3 that perform full-package core upgrades are exposed. The window is during the upgrade itself, when staging paths are reachable from the web. Sites on versions outside that range, or that do not run full-package core upgrades, are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4119,"output_tokens":597,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the exact staging paths, the fixed WordPress version, and whether the flaw depends on upgrade timing, using the NVD entry and WordPress security release notes.","search":"'-119977':15A,18A '-2026':14A,17A '4.7':33B,78C '7.1.3':35B,80C 'access':40B,88C 'attack':7A,51B,104C 'code':9A,58B,74C,107C 'condit':23B 'core':2A,31B,47B,69C,96C 'cve':13A,16A 'due':83C 'execut':57B,75C,106C 'full':45B,94C 'full-packag':44B,93C 'host':28B 'let':6A 'make':99C 'packag':46B,95C 'path':5A,42B,55B,90C 'php':20B 'possibl':101C 'predict':3A,37B,85C 'progress':67B 'race':22B 'race-condit':21B 'rce':24B 'remot':73C 'run':8A 'runtim':25B 'self':27B 'self-host':26B 'server':12A,61B,110C 'stage':41B,89C 'unauthent':50B,103C 'upgrad':4A,48B,64B,97C,113C 'use':36B,53B,91C 'version':32B,77C 'vulner':71C 'web':39B,87C 'web-access':38B,86C 'window':114C 'wordpress':1A,19A,29B,30B,68C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted WordPress sites on core 4.7 through 7.1.3 that have not applied the 7.1.4 (or branch backport) security update. Exposure is only during a full-package core update, when the staging folder under wp-content/upgrade may be reachable and run PHP; this includes automatic background updates. Managed hosts that patched, and sites already on a fixed release, can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-31T06:36:04Z","by":"analyst","doc":"https://wordpress.org/news/2026/10/wordpress-7-1-4/","run_id":1219}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T06:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119977","severity":null,"published_at":"2026-10-31T06:16:34+00:00","modified_at":"2026-10-31T06:16:34+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","fetched_at":"2026-10-31T06:33:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119977:1219","url":null,"severity":null,"published_at":"2026-10-31T06:36:04+00:00","modified_at":"2026-10-31T06:36:04+00:00","first_seen_at":"2026-10-31T06:36:04+00:00","fetched_at":"2026-10-31T06:36:04+00:00","note":"Fixed in WordPress 7.1.4 (vendor release post, which does not name a CVE or paths). Staging path wp-content/upgrade and setup-config.php, exploit attempts (not confirmed compromises), per Wordfence via SecurityWeek/cyberpress; 58k/18.5k blocked requests. Per-branch fixed versions only from secondary sources. exploited left false: attempts only, no confirmed success. Wordfence primary page unavailable to fetch."}],"documents":[{"id":29898,"url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/","title":"WordPress 7.1.4 security release","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":29899,"url":"https://cyberpress.org/hackers-exploit-wordpress-rce-flaw/","title":"Hackers Exploit WordPress RCE Flaw (summarizing Wordfence)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":29900,"url":"https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/","title":"SecurityWeek: Fresh WordPress Vulnerability in Attackers' Crosshairs","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}