CVE-2026-119977 WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
HighCVSS 8.1
EPSS 1.2%
CISA KEV
added 2026-11-03 · due 2026-11-06
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
CISA Known Exploited Vulnerability
- Date added
- 2026-11-03
- Due date (FCEB)
- 2026-11-06
- Ransomware use
- Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress | >= 4.7.0, <= 4.7.38 | No fix listed |
| WordPress | >= 4.8.0, <= 4.8.33 | No fix listed |
| WordPress | >= 4.9.0, <= 4.9.34 | No fix listed |
| WordPress | >= 5.0.0, <= 5.0.30 | No fix listed |
| WordPress | >= 5.1.0, <= 5.1.27 | No fix listed |
| WordPress | >= 5.2.0, <= 5.2.29 | No fix listed |
| WordPress | >= 5.3.0, <= 5.3.26 | No fix listed |
| WordPress | >= 5.4.0, <= 5.4.24 | No fix listed |
| WordPress | >= 5.5.0, <= 5.5.23 | No fix listed |
| WordPress | >= 5.6.0, <= 5.6.22 | No fix listed |
| WordPress | >= 5.7.0, <= 5.7.20 | No fix listed |
| WordPress | >= 5.8.0, <= 5.8.18 | No fix listed |
| WordPress | >= 5.9.0, <= 5.9.19 | No fix listed |
| WordPress | >= 6.0.0, <= 6.0.17 | No fix listed |
| WordPress | >= 6.1.0, <= 6.1.15 | No fix listed |
| WordPress | >= 6.2.0, <= 6.2.14 | No fix listed |
| WordPress | >= 6.3.0, <= 6.3.13 | No fix listed |
| WordPress | >= 6.4.0, <= 6.4.13 | No fix listed |
| WordPress | >= 6.5.0, <= 6.5.13 | No fix listed |
| WordPress | >= 6.6.0, <= 6.6.10 | No fix listed |
| WordPress | >= 6.7.0, <= 6.7.10 | No fix listed |
| WordPress | >= 6.8.0, <= 6.8.11 | No fix listed |
| WordPress | >= 6.9.0, <= 6.9.10 | No fix listed |
| WordPress | >= 7.0.0, <= 7.0.7 | No fix listed |
| WordPress | >= 7.1.0, <= 7.1.3 | No fix listed |
Show 102 more
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress(WordPress) | >= 4.7.0, < 4.7.39 | 4.7.39 |
| WordPress(WordPress) | >= 4.8.0, < 4.8.34 | 4.8.34 |
| WordPress(WordPress) | >= 4.9.0, < 4.9.35 | 4.9.35 |
| WordPress(WordPress) | >= 5.0.0, < 5.0.31 | 5.0.31 |
| WordPress(WordPress) | >= 5.1.0, < 5.1.28 | 5.1.28 |
| WordPress(WordPress) | >= 5.2.0, < 5.2.30 | 5.2.30 |
| WordPress(WordPress) | >= 5.3.0, < 5.3.27 | 5.3.27 |
| WordPress(WordPress) | >= 5.4.0, < 5.4.25 | 5.4.25 |
| WordPress(WordPress) | >= 5.5.0, < 5.5.24 | 5.5.24 |
| WordPress(WordPress) | >= 5.6.0, < 5.6.23 | 5.6.23 |
| WordPress(WordPress) | >= 5.7.0, < 5.7.21 | 5.7.21 |
| WordPress(WordPress) | >= 5.8.0, < 5.8.19 | 5.8.19 |
| WordPress(WordPress) | >= 5.9.0, < 5.9.20 | 5.9.20 |
| WordPress(WordPress) | >= 6.0.0, < 6.0.18 | 6.0.18 |
| WordPress(WordPress) | >= 6.1.0, < 6.1.16 | 6.1.16 |
| WordPress(WordPress) | >= 6.2.0, < 6.2.15 | 6.2.15 |
| WordPress(WordPress) | >= 6.3.0, < 6.3.14 | 6.3.14 |
| WordPress(WordPress) | >= 6.4.0, < 6.4.14 | 6.4.14 |
| WordPress(WordPress) | >= 6.5.0, < 6.5.14 | 6.5.14 |
| WordPress(WordPress) | >= 6.6.0, < 6.6.11 | 6.6.11 |
| WordPress(WordPress) | >= 6.7.0, < 6.7.11 | 6.7.11 |
| WordPress(WordPress) | >= 6.8.0, < 6.8.12 | 6.8.12 |
| WordPress(WordPress) | >= 6.9.0, < 6.9.11 | 6.9.11 |
| WordPress(WordPress) | >= 7.0.0, < 7.0.8 | 7.0.8 |
| WordPress(WordPress) | >= 7.1.0, < 7.1.4 | 7.1.4 |
| debian/wordpress(Debian:12) | All versions | No fix listed |
| debian/wordpress(Debian:12) | = 6.1.1+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.1.6+dfsg1-0+deb12u1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.1.9+dfsg1-0+deb12u1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.2+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.2.1+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.2.2+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.3+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.3.1+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.3.2+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.4.1+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.4.1+dfsg1-1.1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.4.2+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.4.3+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.5+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.5.2+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.5.3+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.5.5+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.6.1+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.7.2+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.7.2+dfsg1-1.1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.8.1+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.8.3+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.9+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 6.9.4+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 7.0+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 7.0.2+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 7.0.3+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 7.1+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 7.1.1+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 7.1.2+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 7.1.3+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:12) | = 7.1.4+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:13) | < 6.8.12+dfsg1-0+deb13u1 | 6.8.12+dfsg1-0+deb13u1 |
| debian/wordpress(Debian:13) | = 6.8.1+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:13) | = 6.8.10+dfsg1-0+deb13u1 | No fix listed |
| debian/wordpress(Debian:13) | = 6.8.3+dfsg1-0+deb13u1 | No fix listed |
| debian/wordpress(Debian:13) | = 6.8.3+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:13) | = 6.8.6+dfsg1-0+deb13u1 | No fix listed |
| debian/wordpress(Debian:13) | = 6.8.7+dfsg1-0+deb13u1 | No fix listed |
| debian/wordpress(Debian:14) | < 7.1.4+dfsg1-1 | 7.1.4+dfsg1-1 |
| debian/wordpress(Debian:14) | = 6.8.1+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:14) | = 6.8.3+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:14) | = 6.9+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:14) | = 6.9.4+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:14) | = 7.0+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:14) | = 7.0.2+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:14) | = 7.0.3+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:14) | = 7.1+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:14) | = 7.1.1+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:14) | = 7.1.2+dfsg1-1 | No fix listed |
| debian/wordpress(Debian:14) | = 7.1.3+dfsg1-1 | No fix listed |
| WordPress | >= 4.7, < 4.7.39 | 4.7.39 |
| WordPress | >= 4.8, < 4.8.34 | 4.8.34 |
| WordPress | >= 4.9, < 4.9.35 | 4.9.35 |
| WordPress | >= 5.0, < 5.0.31 | 5.0.31 |
| WordPress | >= 5.1, < 5.1.28 | 5.1.28 |
| WordPress | >= 5.2, < 5.2.30 | 5.2.30 |
| WordPress | >= 5.3, < 5.3.27 | 5.3.27 |
| WordPress | >= 5.4, < 5.4.25 | 5.4.25 |
| WordPress | >= 5.5, < 5.5.24 | 5.5.24 |
| WordPress | >= 5.6, < 5.6.23 | 5.6.23 |
| WordPress | >= 5.7, < 5.7.21 | 5.7.21 |
| WordPress | >= 5.8, < 5.8.19 | 5.8.19 |
| WordPress | >= 5.9, < 5.9.20 | 5.9.20 |
| WordPress | >= 6.0, < 6.0.18 | 6.0.18 |
| WordPress | >= 6.1, < 6.1.16 | 6.1.16 |
| WordPress | >= 6.2, < 6.2.15 | 6.2.15 |
| WordPress | >= 6.3, < 6.3.14 | 6.3.14 |
| WordPress | >= 6.4, < 6.4.14 | 6.4.14 |
| WordPress | >= 6.5, < 6.5.14 | 6.5.14 |
| WordPress | >= 6.6, < 6.6.11 | 6.6.11 |
| WordPress | >= 6.7, < 6.7.11 | 6.7.11 |
| WordPress | >= 6.8, < 6.8.12 | 6.8.12 |
| WordPress | >= 6.9, < 6.9.11 | 6.9.11 |
| WordPress | >= 7.0, < 7.0.8 | 7.0.8 |
| WordPress | >= 7.1, < 7.1.4 | 7.1.4 |
References
- Debian Security Tracker CVE-2026-119977 vendor-advisory
- www.wordfence.com third-party-advisory
- core.trac.wordpress.org product
- core.trac.wordpress.org product
- core.trac.wordpress.org product
- core.trac.wordpress.org product
- core.trac.wordpress.org patch
- core.trac.wordpress.org patch
- wordpress.org release-notes
- www.wordfence.com third-party-advisory
- www.cisa.gov government-resource us-government-resource
- Red Hat CVE page vendor-advisory
- Red Hat Bugzilla 2564405 issue-tracking
- www.cve.org
- nvd.nist.gov
- www.cisa.gov
- Wordfence Intelligence third-party-advisory