cve-2026-119977

HIGH CVSS 8.1 euvd_kev

Description

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Timeline

Published: Oct 31, 2026, 5:33:07 AM
Last Modified: Nov 4, 2026, 4:56:31 AM

CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "aliases": "GHSA-p6jj-qrp3-7m4g\nCVE-2026-119977\n",
  "cvss": 8.1,
  "datePublished": "Oct 31, 2026, 5:33:07 AM",
  "dateUpdated": "Nov 4, 2026, 4:56:31 AM",
  "description": "WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.",
  "euvdId": "EUVD-2026-114575",
  "exploitedSince": "Nov 3, 2026, 12:00:00 AM",
  "id": "CVE-2026-119977",
  "kev_catalogs": [
    "euvd"
  ],
  "severity": "HIGH",
  "source": "euvd_kev",
  "title": "EUVD-2026-114575"
}

cve-2026-119977

Raw JSON Data