CVE-2026-119977
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
Description
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Known exploited (CISA KEV)
- Name
- WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
- Date added
- 2026-11-03
- Due date
- 2026-11-06 (for US federal agencies)
- Ransomware use
- unknown
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Summary
- WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| WordPress Foundation | WordPress | 4.7.0 to ≤4.7.38; 4.8.0 to ≤4.8.33; 4.9.0 to ≤4.9.34; 5.0.0 to ≤5.0.30; 5.1.0 to ≤5.1.27; 5.2.0 to ≤5.2.29; 5.3.0 to ≤5.3.26; 5.4.0 to ≤5.4.24; 5.5.0 to ≤5.5.23; 5.6.0 to ≤5.6.22; 5.7.0 to ≤5.7.20; 5.8.0 to ≤5.8.18; … |
Affected configurations (NVD)
CPE applicability statements from the NVD's analysis: 1 configuration, 25 CPE matches. In a configuration marked “all of”, the vulnerable product is affected only together with the others listed (for example the hardware it runs on).
CPE matches
| # | CPE | Versions | Role |
|---|---|---|---|
| 1 | wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 4.7, < 4.7.39 | vulnerable |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 4.8, < 4.8.34 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 4.9, < 4.9.35 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 5.0, < 5.0.31 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 5.1, < 5.1.28 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 5.2, < 5.2.30 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 5.3, < 5.3.27 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 5.4, < 5.4.25 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 5.5, < 5.5.24 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 5.6, < 5.6.23 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 5.7, < 5.7.21 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 5.8, < 5.8.19 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 5.9, < 5.9.20 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 6.0, < 6.0.18 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 6.1, < 6.1.16 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 6.2, < 6.2.15 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 6.3, < 6.3.14 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 6.4, < 6.4.14 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 6.5, < 6.5.14 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 6.6, < 6.6.11 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 6.7, < 6.7.11 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 6.8, < 6.8.12 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 6.9, < 6.9.11 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 7.0, < 7.0.8 | vulnerable | |
wordpress wordpresscpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
≥ 7.1, < 7.1.4 | vulnerable |
References
External links from the record. They lead to third-party sites.
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545
- https://wordpress.org/news/2026/10/wordpress-7-1-4/
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-win…
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977