CVE-2026-119977

Published 31 October 2026 · tracked since 31 October 2026

Description

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-118636 CRITICAL 9.8
• CVE-2026-120203 HIGH 8.8
• CVE-2026-76010 HIGH 8.8
• CVE-2026-120114 HIGH 7.2
• CVE-2026-109197 HIGH 7.5
• CVE-2026-118235 CRITICAL 9.8
• CVE-2026-120075 HIGH 7.2
• CVE-2026-103882 CRITICAL 9.1
• CVE-2026-110530 HIGH 7.2
• CVE-2026-119096 CRITICAL 9.8

→ Open the live CVE board · all tools