CVE-2026-119977
HIGHCVSS 8.1/10
Last modified
CVE-2026-119977 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
Description
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| WordPress Foundation | WordPress | >= 4.7.0, <= 4.7.38; >= 4.8.0, <= 4.8.33; >= 4.9.0, <= 4.9.34; >= 5.0.0, <= 5.0.30; >= 5.1.0, <= 5.1.27; >= 5.2.0, <= 5.2.29; >= 5.3.0, <= 5.3.26; >= 5.4.0, <= 5.4.24; >= 5.5.0, <= 5.5.23; >= 5.6.0, <= 5.6.22; >= 5.7.0, <= 5.7.20; >= 5.8.0, <= 5.8.18; >= 5.9.0, <= 5.9.19; >= 6.0.0, <= 6.0.17; >= 6.1.0, <= 6.1.15; >= 6.2.0, <= 6.2.14; >= 6.3.0, <= 6.3.13; >= 6.4.0, <= 6.4.13; >= 6.5.0, <= 6.5.13; >= 6.6.0, <= 6.6.10; >= 6.7.0, <= 6.7.10; >= 6.8.0, <= 6.8.11; >= 6.9.0, <= 6.9.10; >= 7.0.0, <= 7.0.7; >= 7.1.0, <= 7.1.3 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-119977?
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
How severe is CVE-2026-119977?
CVE-2026-119977 has a CVSS score of 8.1/10 (HIGH severity).
How do I fix CVE-2026-119977?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11992The Easy Appointments plugin for WordPress is vulnerable to …4.3
- CVE-2026-11993Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7…4.3
- CVE-2026-11994Akaunting 3.1.21 contains an authenticated stored Cross-Site…4.8
- CVE-2026-11995The Gutena Forms – Contact Form, Survey Form, Feedback Form,…5.3
- CVE-2026-11996The Advanced Popups plugin for WordPress is vulnerable to St…6.4
- CVE-2026-11997The Bulk SEO Image plugin for WordPress is vulnerable to Cro…4.3
- CVE-2026-119978Flowise through 3.1.4 contains a sandbox escape vulnerabilit…8.5
- CVE-2026-119979LM Studio before 0.4.22+1 contains a path traversal vulnerab…8.8
- CVE-2026-11998A flaw in AngularJS' Strict Contextual Escaping (SCE) logic …7.6
- CVE-2026-119980The UsersWP – Front-end login form, User Registration, User …6.5
- CVE-2026-11999X.509 trust-chain bypass (path-depth exhaustion) in the Open…7.5
- CVE-2026-1200A flaw was found in the rgaufman/live555 fork of live555. A …6.3
Are you affected by CVE-2026-119977?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST