---
id: "CVE-2026-119977"
kind: "vulnerability"
aliases: ["CVE-2026-119977"]
title: "WordPress Core: predictable upgrade paths let attackers run code on the server"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "WordPress", "fixed": ["7.1.4"], "affected": ">= 4.7, <= 7.1.3", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["php", "race-condition", "rce", "runtime", "self-hosted", "wordpress"]
not_affected_if: ["managed-hosting", "patched-version", "upgrade-dir-not-web-accessible", "version-outside-range"]
published_at: "2026-10-31T06:16:34+00:00"
first_seen_at: "2026-10-31T06:33:50+00:00"
updated_at: "2026-10-31T06:36:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119977", "first_seen_at": "2026-10-31T06:33:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T06:36:04+00:00"}]
---

# WordPress Core: predictable upgrade paths let attackers run code on the server

WordPress Core versions 4.7 through 7.1.3 use predictable, web-accessible staging paths during full-package core upgrades. An unauthenticated attacker can use those paths to execute code on the server while an upgrade is in progress.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:WordPress affected >= 4.7, <= 7.1.3 fixed 7.1.4

## How to check

- Run 'wp core version' or open Dashboard > Updates. Versions 4.7 through 7.1.3 without the security update for your branch are affected.
- Look in your web logs for requests to wp-content/upgrade/ paths (especially setup-config.php) and check for unexpected wp-config.php changes, new admin users, plugins or PHP files.
- Exposure needs: full-package core update in progress, wp-content/upgrade reachable over the web with PHP execution.

## Fix

Update to WordPress 7.1.4 (Dashboard > Updates). For older branches WordPress says the fix is backported to all branches still eligible for security fixes (back to 4.7) and backports 'ship as they become ready'; check Dashboard > Updates for your branch's release. Secondary reports list 7.0.8, 6.9.11, 6.8.12 ... 4.7.39; not confirmed on the vendor page. Fix per reports: randomized staging directory names, an index guard, no unsafe promotion of staged config.

## Timeline

- 2026-10-31T06:33:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119977
- 2026-10-31T06:36:04+00:00 analyst — Fixed in WordPress 7.1.4 (vendor release post, which does not name a CVE or paths). Staging path wp-content/upgrade and setup-config.php, exploit attempts (not confirmed compromises), per Wordfence via SecurityWeek/cyberpress; 58k/18.5k blocked requests. Per-branch fixed versions only from secondary sources. exploited left false: attempts only, no confirmed success. Wordfence primary page unavailable to fetch.

## Documents

- [advisory] WordPress 7.1.4 security release https://wordpress.org/news/2026/10/wordpress-7-1-4/
- [describes] Hackers Exploit WordPress RCE Flaw (summarizing Wordfence) https://cyberpress.org/hackers-exploit-wordpress-rce-flaw/
- [describes] SecurityWeek: Fresh WordPress Vulnerability in Attackers' Crosshairs https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/

## From the sources

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_