No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Exploits & detection
Exploitlysophavin18/CVE-2026-119977 · github · ★ 3 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
ExploitWorthes/CVE-2026-119977-WordPress-Upgrade-RCE-Bypasses-7.1.4 · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Exploitfoxcornlab/wordpress-core-scanner · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
In the news
- Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress CoreWordfence · 05 Nov 2026
- CISA Confirms Hackers Exploiting WordPress Core Flaw During Software UpgradesThe Hacker News · 04 Nov 2026
- WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After ReleaseWordfence · 29 Oct 2026
Timeline
- Published: 31 Oct 2026
- Last modified upstream: 04 Nov 2026
- Added to CISA KEV: 03 Nov 2026
Sources & licenses
- Vulnerability data
- Wordfence Intelligence — record ↗ · Copyright Defiant Inc.
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- advisory WordPress 7.1.4
- wordfence WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162 (Product)
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378 (Product)
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549 (Product)
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282 (Product)
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346 (Patch)
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545 (Patch)
- https://wordpress.org/news/2026/10/wordpress-7-1-4/ (Release Notes)
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve (Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977 (US Government Resource)
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution (Third Party Advisory)
- Analysis, summary and remediation
- © VulnCrest