CVE Tools
Track your stack

CVE-2026-119977

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

Exploited in the wild. In CISA KEV since 2026‑11‑03. No fix published yet.

CVSS 3.18.1HighEPSS percentile49th0.6% chance in 30 daysCISA KEVListedsince 2026-11-03, due 2026-11-06
No public exploit knownFixNone yetNo fix or workaround published
Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published Updated Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

  • WordPress Foundation WordPressAffected: ≥ 4.7.0, ≤ 4.7.38Upgrade to: after 4.7.38Affected: ≥ 4.8.0, ≤ 4.8.33Upgrade to: after 4.8.33Affected: ≥ 4.9.0, ≤ 4.9.34Upgrade to: after 4.9.34Affected: ≥ 5.0.0, ≤ 5.0.30Upgrade to: after 5.0.30 + 21 more branchesStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record
  1. Check your WordPress version in the admin dashboard — if it's anywhere between 4.7 and 7.1.3, you are affected.
  2. Confirm there is no official patched version yet; watch WordPress.org and your hosting provider for an emergency security release.
  3. Avoid running a WordPress core upgrade on an internet-exposed site until a fix is confirmed, or restrict server access during any upgrade window.
  4. Ask your host or security provider about a web application firewall rule or temporary block on staging-path access as an interim measure.
  5. As soon as an official patch is released, apply it immediately, since this is already being actively exploited.
May need vendor or contractor work
Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

0 publishers

  1. Added to CISA KEV catalog

    ·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened.

What it is

From the CVE record

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

In plain language

Written by AI from the record

This is a serious weakness in WordPress Core (versions 4.7 through 7.1.3) that attackers are already exploiting, and there is no fix available yet, so every WordPress site should treat this as urgent.

Unauthenticated remote code execution in WordPress Core 4.7–7.1.3 arising from predictable, web-accessible staging paths exposed during full-package core upgrades, allowing an attacker to drop and execute code on the server while an upgrade is in progress (CWE-367, race condition on a time-of-check/time-of-use file path).

If you're affected

  • Full server takeover
  • Website defacement
  • Customer data exposure
  • Malware or ransomware deployment
  • Site downtime

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS49th
CISA KEV
CISA KEV

Listed as exploited in the wild since 2026-11-03.

US federal agencies must remediate by 2026-11-06.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 49th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 3 days, from the signal feeds we watch.

  1. Added to CISA KEVrecord updated
  2. Record updated
  3. Publishedweakness classified, att&ck mapped, record updated

Affected products

Scale

How widely the affected products are used. This is not a count of vulnerable hosts.

Estimate Public sources, each figure dated. How much of it is already patched is not known.

WordPress

Web

  • 58%of websites

    Among websites whose content management system we know.

    W3Techs ↗ · as of 2 Nov 2026 · Medium confidence

Version split · W3Techs · as of 2 Nov 2026

  • 7.156%
  • 7.012%
  • 6.99.1%
  • 6.86%
  • 54.7%
  • 6.72.8%
  • Other listed9.6%

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

  • Attack Vector NetworkExploitable remotely over the network without any special conditions
  • Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
  • Privileges Required NoneNo authentication required — anyone can exploit this
  • User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

  • Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

  • Confidentiality HighTotal information disclosure — all data in the component is compromised
  • Integrity HighTotal loss of integrity — attacker can modify any data in the component
  • Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Sources

References in the record

And 7 more references. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for WordPress, not every advisory. This one: actively exploited.