CVE-2026-119977
High8.1CISA KEV — exploited in the wildWordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Executiontitle from the CVE record
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
- CVSS
- 8.1v3.1
- EPSS (exploit probability)
- 0.6%49th pct
- CISA KEV
- Listed
EPSS trendFIRST daily scores, last 90 days
Daily values
| Score date | EPSS | Percentile |
|---|---|---|
| 2026-11-03 | 0.6% | 48.8% |
| 2026-11-02 | 0.6% | 48.7% |
| 2026-11-01 | 0.6% | 48.7% |
| 2026-10-31 | 0.6% | 48.7% |
CISA KEV entrycatalogue 2026.11.03
- Date added
- 2026-11-03
- Federal due date
- 2026-11-06
- Known ransomware use
- Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Verbatim from the CISA KEV catalogue (CISA KEV, fetched 2026-11-03 22:55 UTC). The due date applies to US federal agencies under BOD 22-01.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Learn
Why it happened and what stops it
The weakness (CWE)
How attackers use it (ATT&CK)
Typical for this kind of weakness across CISA KEV exploits (CTID), not specific to this CVE.
How it's exploited
What the attacker gets
Controls that mitigate it (NIST SP 800-53)
- AC-6Least PrivilegeAccess Control · mitigates 2 of these techniques
- CA-7Continuous MonitoringSecurity Assessment and Authorization · mitigates 2 of these techniques
- CM-8System Component InventoryConfiguration Management · mitigates 2 of these techniques
- SC-18Mobile CodeSystem and Communications Protection · mitigates 2 of these techniques
- SI-3Malicious Code ProtectionSystem and Information Integrity · mitigates 2 of these techniques
- SI-4System MonitoringSystem and Information Integrity · mitigates 2 of these techniques
Coverage2 articles
References
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545
- https://wordpress.org/news/2026/10/wordpress-7-1-4/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution