WordPress Core 4.7 through 7.1.3 unauthenticated remote code execution during upgrades (CVE-2026-119977)

What happened

WordPress Core versions 4.7 through 7.1.3 are vulnerable to remote code execution. During a full-package core upgrade, WordPress uses staging paths that are predictable and web-accessible. An unauthenticated attacker can reach those paths during the upgrade window and execute code on the server. The weakness is recorded as CWE-367, a time-of-check to time-of-use flaw.

The CVSS 3.1 score is 8.1 (high): the attack vector is the network, no privileges or user interaction are required, and a successful attack has high impact on confidentiality, integrity and availability. Attack complexity is high.

CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on 2026-11-03 with a due date of 2026-11-06. CISA's SSVC assessment records active exploitation, and ENISA EUVD lists the flaw as exploited since 2026-11-03.

Who is affected

WordPress Core versions 4.7 through 7.1.3 are affected. The fixed releases listed below cover every affected branch. If your installation runs any version in this range, apply the matching branch fix before proceeding.

What to do now

1. Upgrade immediately to the fixed release for your installed branch. WordPress has published: 4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8 and 7.1.4.

1. Treat this as urgent. CISA's KEV due date is 2026-11-06 and ENISA EUVD records exploitation since 2026-11-03. No standalone vendor workaround is listed. If you cannot update immediately, restrict network access to the WordPress admin area and upgrade-related staging paths until the fixed release is installed, and review access logs for unexpected requests to those paths.

1. For internet-exposed installations, verify each site has been updated to one of the fixed versions. If mitigations are unavailable, follow CISA's KEV required action and discontinue use of the product.

How to detect it

Because the attack depends on web-accessible staging paths during a full-package core upgrade, review web server access logs for unexpected requests to wp-admin/includes/class-core-upgrader.php, class-wp-upgrader.php, update-core.php or setup-config.php from external or non-administrative clients. Correlate these requests with the timing of planned core upgrades and investigate any access outside an authorised change window.

Beyond the patch

This is an actively exploited, network-reachable remote code execution flaw in WordPress Core. Patching is the immediate task, but organisations also need to detect and respond to any activity that occurred before patching and to find installations that are exposed without their owners realising. Managed Detection & Response (MDR) provides detection and response for post-exploitation activity, and Virtual CISO Services (vCISO) can help identify internet-exposed WordPress Core instances and establish a repeatable patching and exposure-review routine.