CVE-2026-119977: WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Other sources
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
— CISA
Affected Software
Event History
Frequently Asked Questions
What conditions create the exposure?
The exposure occurs during full-package WordPress core upgrades, when predictable staging paths are web-accessible. The vulnerable condition is limited to the upgrade window.
Does an attacker need a WordPress account or user interaction to exploit this issue?
No. The vulnerability is described as unauthenticated and requires no user interaction, although exploitation involves a time-of-check time-of-use race condition.
How urgently should this be treated?
This issue is flagged as exploited and was KEV-listed on 2026-11-03. It has high severity with impacts to confidentiality, integrity, and availability.