CVE-2026-119977 (GCVE-0-2026-119977)
Vulnerability from cvelistv5
Published
2026-10-31 05:33
Modified
2026-11-04 04:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Summary
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| WordPress Foundation | WordPress |
Version: 4.7.0 ≤ 4.7.38 Version: 4.8.0 ≤ 4.8.33 Version: 4.9.0 ≤ 4.9.34 Version: 5.0.0 ≤ 5.0.30 Version: 5.1.0 ≤ 5.1.27 Version: 5.2.0 ≤ 5.2.29 Version: 5.3.0 ≤ 5.3.26 Version: 5.4.0 ≤ 5.4.24 Version: 5.5.0 ≤ 5.5.23 Version: 5.6.0 ≤ 5.6.22 Version: 5.7.0 ≤ 5.7.20 Version: 5.8.0 ≤ 5.8.18 Version: 5.9.0 ≤ 5.9.19 Version: 6.0.0 ≤ 6.0.17 Version: 6.1.0 ≤ 6.1.15 Version: 6.2.0 ≤ 6.2.14 Version: 6.3.0 ≤ 6.3.13 Version: 6.4.0 ≤ 6.4.13 Version: 6.5.0 ≤ 6.5.13 Version: 6.6.0 ≤ 6.6.10 Version: 6.7.0 ≤ 6.7.10 Version: 6.8.0 ≤ 6.8.11 Version: 6.9.0 ≤ 6.9.10 Version: 7.0.0 ≤ 7.0.7 Version: 7.1.0 ≤ 7.1.3 |
CISA Known Exploited Vulnerability
Data from the CISA Known Exploited Vulnerabilities Catalog
Date added: 2026-11-03
Due date: 2026-11-06
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Used in ransomware: Unknown
Notes: https://wordpress.org/news/2026/10/wordpress-7-1-4 ; https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-119977
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119977",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-11-03",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T04:56:31.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "CVE-2026-119977 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "WordPress Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.38",
"status": "affected",
"version": "4.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.8.33",
"status": "affected",
"version": "4.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.34",
"status": "affected",
"version": "4.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.0.30",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.1.27",
"status": "affected",
"version": "5.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.29",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.3.26",
"status": "affected",
"version": "5.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.24",
"status": "affected",
"version": "5.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.5.23",
"status": "affected",
"version": "5.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.6.22",
"status": "affected",
"version": "5.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.7.20",
"status": "affected",
"version": "5.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.8.18",
"status": "affected",
"version": "5.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.9.19",
"status": "affected",
"version": "5.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.17",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.15",
"status": "affected",
"version": "6.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.14",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.13",
"status": "affected",
"version": "6.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.13",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.13",
"status": "affected",
"version": "6.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.10",
"status": "affected",
"version": "6.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.7.10",
"status": "affected",
"version": "6.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.11",
"status": "affected",
"version": "6.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.9.10",
"status": "affected",
"version": "6.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.7",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.3",
"status": "affected",
"version": "7.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Umut Bayram"
}
],
"descriptions": [
{
"lang": "en",
"value": "WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T05:33:07.059Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve"
},
{
"url": "https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378"
},
{
"url": "https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162"
},
{
"url": "https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549"
},
{
"url": "https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282"
},
{
"url": "https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346"
},
{
"url": "https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545"
},
{
"url": "https://wordpress.org/news/2026/10/wordpress-7-1-4/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-28T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-119977",
"datePublished": "2026-10-31T05:33:07.059Z",
"dateReserved": "2026-10-30T17:17:35.145Z",
"dateUpdated": "2026-11-04T04:56:31.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"cisa_known_exploited": {
"cveID": "CVE-2026-119977",
"cwes": "[\"CWE-367\"]",
"dateAdded": "2026-11-03",
"dueDate": "2026-11-06",
"forensicTriage": "Yes",
"knownRansomwareCampaignUse": "Unknown",
"notes": "https://wordpress.org/news/2026/10/wordpress-7-1-4 ; https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-119977",
"product": "WordPress Core",
"requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"shortDescription": "WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.",
"vendorProject": "WordPress",
"vulnerabilityName": "WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-119977\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-11-03T20:50:05.434105Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2026-11-03\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977\"}}}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-11-03T17:48:54.520Z\"}, \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-11-03T00:00:00.000Z\", \"value\": \"CVE-2026-119977 added to CISA KEV\"}]}], \"cna\": {\"title\": \"WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Umut Bayram\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"WordPress Foundation\", \"product\": \"WordPress\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.7.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.7.38\"}, {\"status\": \"affected\", \"version\": \"4.8.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.8.33\"}, {\"status\": \"affected\", \"version\": \"4.9.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.34\"}, {\"status\": \"affected\", \"version\": \"5.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.0.30\"}, {\"status\": \"affected\", \"version\": \"5.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.1.27\"}, {\"status\": \"affected\", \"version\": \"5.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.2.29\"}, {\"status\": \"affected\", \"version\": \"5.3.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.3.26\"}, {\"status\": \"affected\", \"version\": \"5.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.24\"}, {\"status\": \"affected\", \"version\": \"5.5.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.5.23\"}, {\"status\": \"affected\", \"version\": \"5.6.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.6.22\"}, {\"status\": \"affected\", \"version\": \"5.7.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.7.20\"}, {\"status\": \"affected\", \"version\": \"5.8.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.8.18\"}, {\"status\": \"affected\", \"version\": \"5.9.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.9.19\"}, {\"status\": \"affected\", \"version\": \"6.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.17\"}, {\"status\": \"affected\", \"version\": \"6.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.15\"}, {\"status\": \"affected\", \"version\": \"6.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.2.14\"}, {\"status\": \"affected\", \"version\": \"6.3.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.3.13\"}, {\"status\": \"affected\", \"version\": \"6.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.4.13\"}, {\"status\": \"affected\", \"version\": \"6.5.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.5.13\"}, {\"status\": \"affected\", \"version\": \"6.6.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.10\"}, {\"status\": \"affected\", \"version\": \"6.7.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.10\"}, {\"status\": \"affected\", \"version\": \"6.8.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.11\"}, {\"status\": \"affected\", \"version\": \"6.9.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.10\"}, {\"status\": \"affected\", \"version\": \"7.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.0.7\"}, {\"status\": \"affected\", \"version\": \"7.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.1.3\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-10-28T00:00:00.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545\"}, {\"url\": \"https://wordpress.org/news/2026/10/wordpress-7-1-4/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-367\", \"description\": \"CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-10-31T05:33:07.059Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-119977\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-11-03T20:58:23.478Z\", \"dateReserved\": \"2026-10-30T17:17:35.145Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-10-31T05:33:07.059Z\", \"assignerShortName\": \"Wordfence\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…