SECURITYHIGHCVE-2026-119977

CVE-2026-119977: WordPress Core Upgrade-Window Remote Code Execution

WordPress Core 4.7 through 7.1.3 exposes predictable staging paths during full-package upgrades, letting unauthenticated attackers execute code.

Dylan H.

Security Team

October 31, 2026
2 min read
CVE-2026-119977: WordPress Core Upgrade-Window Remote Code Execution

Affected Products

  • WordPress Core 4.7 through 7.1.3

CVE-2026-119977: WordPress Core Upgrade-Window RCE

CVE-2026-119977 (CVSS 8.1, High) is a remote code execution vulnerability in WordPress Core versions 4.7 through 7.1.3. It stems from predictable, web-accessible staging paths used during full-package core upgrades. An unauthenticated attacker can execute code on the server during the upgrade window.

WordPress 7.1.4, released October 28, 2026, addresses the flaw. Attack attempts at scale were reported shortly after the patch, so treat unpatched sites as at risk.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-119977
CVSS Score8.1 (High)
Affected SoftwareWordPress Core
Affected Versions4.7 through 7.1.3
Fixed Version7.1.4
Authentication RequiredNone
Attack VectorNetwork, during a full-package core upgrade
ExploitationAttack attempts observed in the wild

Technical Background

During full-package core upgrades, affected versions unpack files into a predictable directory under wp-content/upgrade. That directory is reachable over the web and can contain installer files. If an attacker requests those files while the upgrade is unpacking, they can progress to PHP code execution.

The attack is a race against the cleanup step, so attackers poll candidate paths repeatedly. Exploitation depends on:

  • A full-package update that includes installer files
  • Web and PHP access to the staging tree
  • A guessable staging path
  • Enough time before WordPress removes the temporary files

Remediation

  1. Update to WordPress 7.1.4 and enable automatic core updates where practical.
  2. Block web access to wp-content/upgrade at the web server or WAF.
  3. Schedule upgrades in low-traffic windows and watch logs while they run.
# Check and update core with WP-CLI
wp core version
wp core update

Detection

Review access logs for requests to PHP files under wp-content/upgrade, and for probes such as setup-config.php. Audit for unfamiliar administrator accounts, plugins, themes, or PHP files.

grep "wp-content/upgrade" /var/log/nginx/access.log | grep "\.php" | tail -100
wp user list --role=administrator --fields=user_login,user_registered --format=table

Key Takeaways

  1. CVE-2026-119977 affects every WordPress Core release from 4.7 through 7.1.3.
  2. No authentication is needed, but the attacker must hit the upgrade window.
  3. Update to 7.1.4 and block web access to the upgrade staging directory.

Sources