WordPress Core unauthenticated remote code execution during core upgrades (CVE-2026-119977)

What happened

WordPress Core 4.7 through 7.1.3 contains a remote code execution flaw. During a full-package core upgrade, the updater creates staging paths that are predictable and web-accessible. An unauthenticated attacker who can reach the site over the network can use those paths during the upgrade window to execute code on the server. No privileges or user interaction are required, but attack complexity is high because the vulnerable window is limited. The CVSS 3.1 score is 8.1, rated high: network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality, integrity and availability impact.

The CVE record does not report exploitation or public disclosure.

Who is affected

The CVE title and description state that WordPress Core 4.7 through 7.1.3 is affected. The CVE record's affected list enumerates these release lines: 4.7.0 to 4.7.38, 4.8.0 to 4.8.33, 4.9.0 to 4.9.34, 5.0.0 to 5.0.30, 5.1.0 to 5.1.27, 5.2.0 to 5.2.29, 5.3.0 to 5.3.26, and 5.4.0 to 5.4.24. The affected list does not enumerate releases above 5.4.24, although the title and description set the upper bound at 7.1.3. WordPress is typically public-facing and internet-exposed, so any site running these versions should be reviewed.

What to do now

1. Identify all WordPress Core instances running versions from 4.7 through 7.1.3.
2. No fixed version is listed in the CVE record, and no workaround is stated. Do not treat any release as a confirmed fix without checking the WordPress release information and Trac references linked on this page.
3. Restrict network access to the WordPress installation and to staging directories used during core upgrades. Do not expose the upgrade process to the public internet.
4. If a full-package core upgrade cannot be avoided, run it during a maintenance window and monitor the server and access logs for the duration of the window.

How to detect it

The CVE record does not provide specific indicators of compromise. During any core upgrade, review access logs for requests to the predictable staging paths described above, and watch for unexpected file modifications or processes in the web root while the upgrade window is open.

Beyond the patch

Public WordPress sites are public-facing platforms, and this flaw sits inside the core upgrade procedure rather than a plugin. Our Implementation & Assessment Services can review a WordPress deployment for predictable staging paths and upgrade hygiene, while Managed Detection & Response detects the code execution and follow-on activity if an upgrade window is abused.