WordPress Core: Remote code execution via predictable upgrade staging paths
Summary
WordPress Core versions 4.7 through 7.1.3 use predictable, web-accessible staging paths during full-package core upgrades. An unauthenticated attacker can exploit this to execute code on the server during the upgrade window. The attack requires an upgrade to be in progress, which makes exploitation conditional, and the CVSS base score is 8.1 (High).
Affected
- WordPress Core 4.7.0 to 4.7.38
- WordPress Core 4.8.0 to 4.8.33
- WordPress Core 4.9.0 to 4.9.34
- WordPress Core 5.0.0 to 5.0.30
- WordPress Core 5.1.0 to 5.1.27
- WordPress Core 5.2.0 to 5.2.29
- WordPress Core 5.3.0 to 5.3.26
- WordPress Core 5.4.0 to 5.4.24
- WordPress Core 5.5.0 to 5.5.23
- WordPress Core 5.6.0 to 5.6.22
- WordPress Core 5.7.0 to 5.7.20
- WordPress Core 5.8.0 to 5.8.18
- Overall range per NVD: 4.7 through 7.1.3
- Branches 5.9 to 7.1.3: see the vendor advisory for the exact affected versions
Fixed in
- WordPress 7.1.4 (released 28 October 2026)
- Backported fixes for older branches: secondary sources name 4.7.39, 7.0.8 and 6.9.11. Confirm the exact version per branch in the official WordPress release archive.
- Fixed version for 6.8.x and older branches: Unknown.
- Sites on 4.6 or earlier receive no fix and need a supported release.
Workaround
- Update WordPress Core to the patched release. This is the supported fix.
- If you cannot update yet, deny web access to wp-content/upgrade/ at the web server and make sure the directory is not listable.
- Third-party updaters that bypass core routines may still use predictable paths in wp-content/. Check them as well.
Exploitation
- Wordfence and media reports describe exploitation attempts shortly after the 7.1.4 release. The reported figures differ (about 58,000 to 63,000 blocked attempts in 24 hours) and could not be verified.
- Not listed in the CISA KEV catalog as of 31 October 2026.
- No public proof-of-concept specific to CVE-2026-119977 was found. Do not confuse it with CVE-2026-60137 and CVE-2026-63030, which affect other versions.
Our recommendation
- Update all WordPress Core installations to 7.1.4 or the patched release for your branch without delay.
- Check whether your sites are running a version in the affected range. Also check for signs of compromise, such as unknown PHP files in wp-content/upgrade/ or in the WordPress directories.
- Apply the web server rule for wp-content/upgrade/ until patching is complete.
- Monitor web server logs for requests to upgrade paths from unknown sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WordPress 7.1.4 Release wordpress.org
- Wordfence threat intelligence entry www.wordfence.com
- Rapid7 vulnerability entry www.rapid7.com
- Patchstack: WordPress 7.1.4 security release patchstack.com
- Brandefense: WordPress 7.1.4 security update brandefense.io
- Rescana: WordPress Core 7.1.4 upgrade staging RCE www.rescana.com
- The Hacker News: WordPress RCE flaw draws nearly 63,000 attacks thehackernews.com
- OffSeq Radar: CVE-2026-119977 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:43.
Original description (NVD)
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
NVD references (8)
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346
- https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545
- https://wordpress.org/news/2026/10/wordpress-7-1-4/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.