blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-119977

HIGH 8.1 CVSS 3.1
Published
October 31, 2026
Last modified
November 4, 2026
NVD status
Analyzed
Reported by
security@wordfence.com
Weakness
CWE-367
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Affected WordPress components

  • WordPress core
    Confirmed match
    From 4.7 (including) to 4.7.39 (excluding); From 4.8 (including) to 4.8.34 (excluding); From 4.9 (including) to 4.9.35 (excluding); From 5.0 (including) to 5.0.31 (excluding); From 5.1 (including) to 5.1.28 (excluding); From 5.2 (including) to 5.2.30 (excluding); From 5.3 (including) to 5.3.27 (excluding); From 5.4 (including) to 5.4.25 (excluding); From 5.5 (including) to 5.5.24 (excluding); From 5.6 (including) to 5.6.23 (excluding); From 5.7 (including) to 5.7.21 (excluding); From 5.8 (including) to 5.8.19 (excluding); From 5.9 (including) to 5.9.20 (excluding); From 6.0 (including) to 6.0.18 (excluding); From 6.1 (including) to 6.1.16 (excluding); From 6.2 (including) to 6.2.15 (excluding); From 6.3 (including) to 6.3.14 (excluding); From 6.4 (including) to 6.4.14 (excluding); From 6.5 (including) to 6.5.14 (excluding); From 6.6 (including) to 6.6.11 (excluding); From 6.7 (including) to 6.7.11 (excluding); From 6.8 (including) to 6.8.12 (excluding); From 6.9 (including) to 6.9.11 (excluding); From 7.0 (including) to 7.0.8 (excluding); From 7.1 (including) to 7.1.4 (excluding)
  • wordpress Plugin · wordpress
    Possible match Homeless
    From 4.7.0 (including) to 4.7.38 (including); From 4.8.0 (including) to 4.8.33 (including); From 4.9.0 (including) to 4.9.34 (including); From 5.0.0 (including) to 5.0.30 (including); From 5.1.0 (including) to 5.1.27 (including); From 5.2.0 (including) to 5.2.29 (including); From 5.3.0 (including) to 5.3.26 (including); From 5.4.0 (including) to 5.4.24 (including); From 5.5.0 (including) to 5.5.23 (including); From 5.6.0 (including) to 5.6.22 (including); From 5.7.0 (including) to 5.7.20 (including); From 5.8.0 (including) to 5.8.18 (including); From 5.9.0 (including) to 5.9.19 (including); From 6.0.0 (including) to 6.0.17 (including); From 6.1.0 (including) to 6.1.15 (including); From 6.2.0 (including) to 6.2.14 (including); From 6.3.0 (including) to 6.3.13 (including); From 6.4.0 (including) to 6.4.13 (including); From 6.5.0 (including) to 6.5.13 (including); From 6.6.0 (including) to 6.6.10 (including); From 6.7.0 (including) to 6.7.10 (including); From 6.8.0 (including) to 6.8.11 (including); From 6.9.0 (including) to 6.9.10 (including); From 7.0.0 (including) to 7.0.7 (including); From 7.1.0 (including) to 7.1.3 (including)
    View on WordPress.org
  • wordpress Theme · wordpress
    Possible match Homeless
    From 4.7.0 (including) to 4.7.38 (including); From 4.8.0 (including) to 4.8.33 (including); From 4.9.0 (including) to 4.9.34 (including); From 5.0.0 (including) to 5.0.30 (including); From 5.1.0 (including) to 5.1.27 (including); From 5.2.0 (including) to 5.2.29 (including); From 5.3.0 (including) to 5.3.26 (including); From 5.4.0 (including) to 5.4.24 (including); From 5.5.0 (including) to 5.5.23 (including); From 5.6.0 (including) to 5.6.22 (including); From 5.7.0 (including) to 5.7.20 (including); From 5.8.0 (including) to 5.8.18 (including); From 5.9.0 (including) to 5.9.19 (including); From 6.0.0 (including) to 6.0.17 (including); From 6.1.0 (including) to 6.1.15 (including); From 6.2.0 (including) to 6.2.14 (including); From 6.3.0 (including) to 6.3.13 (including); From 6.4.0 (including) to 6.4.13 (including); From 6.5.0 (including) to 6.5.13 (including); From 6.6.0 (including) to 6.6.10 (including); From 6.7.0 (including) to 6.7.10 (including); From 6.8.0 (including) to 6.8.11 (including); From 6.9.0 (including) to 6.9.10 (including); From 7.0.0 (including) to 7.0.7 (including); From 7.1.0 (including) to 7.1.3 (including)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • WordPress Foundation WordPress — From 4.7.0 (including) to 4.7.38 (including)
  • WordPress Foundation WordPress — From 4.8.0 (including) to 4.8.33 (including)
  • WordPress Foundation WordPress — From 4.9.0 (including) to 4.9.34 (including)
  • WordPress Foundation WordPress — From 5.0.0 (including) to 5.0.30 (including)
  • WordPress Foundation WordPress — From 5.1.0 (including) to 5.1.27 (including)
  • WordPress Foundation WordPress — From 5.2.0 (including) to 5.2.29 (including)
  • WordPress Foundation WordPress — From 5.3.0 (including) to 5.3.26 (including)
  • WordPress Foundation WordPress — From 5.4.0 (including) to 5.4.24 (including)
  • WordPress Foundation WordPress — From 5.5.0 (including) to 5.5.23 (including)
  • WordPress Foundation WordPress — From 5.6.0 (including) to 5.6.22 (including)
  • WordPress Foundation WordPress — From 5.7.0 (including) to 5.7.20 (including)
  • WordPress Foundation WordPress — From 5.8.0 (including) to 5.8.18 (including)
  • WordPress Foundation WordPress — From 5.9.0 (including) to 5.9.19 (including)
  • WordPress Foundation WordPress — From 6.0.0 (including) to 6.0.17 (including)
  • WordPress Foundation WordPress — From 6.1.0 (including) to 6.1.15 (including)
  • WordPress Foundation WordPress — From 6.2.0 (including) to 6.2.14 (including)
  • WordPress Foundation WordPress — From 6.3.0 (including) to 6.3.13 (including)
  • WordPress Foundation WordPress — From 6.4.0 (including) to 6.4.13 (including)
  • WordPress Foundation WordPress — From 6.5.0 (including) to 6.5.13 (including)
  • WordPress Foundation WordPress — From 6.6.0 (including) to 6.6.10 (including)
  • WordPress Foundation WordPress — From 6.7.0 (including) to 6.7.10 (including)
  • WordPress Foundation WordPress — From 6.8.0 (including) to 6.8.11 (including)
  • WordPress Foundation WordPress — From 6.9.0 (including) to 6.9.10 (including)
  • WordPress Foundation WordPress — From 7.0.0 (including) to 7.0.7 (including)
  • WordPress Foundation WordPress — From 7.1.0 (including) to 7.1.3 (including)
  • wordpress wordpress — From 4.7 (including) to 4.7.39 (excluding)
  • wordpress wordpress — From 4.8 (including) to 4.8.34 (excluding)
  • wordpress wordpress — From 4.9 (including) to 4.9.35 (excluding)
  • wordpress wordpress — From 5.0 (including) to 5.0.31 (excluding)
  • wordpress wordpress — From 5.1 (including) to 5.1.28 (excluding)
  • wordpress wordpress — From 5.2 (including) to 5.2.30 (excluding)
  • wordpress wordpress — From 5.3 (including) to 5.3.27 (excluding)
  • wordpress wordpress — From 5.4 (including) to 5.4.25 (excluding)
  • wordpress wordpress — From 5.5 (including) to 5.5.24 (excluding)
  • wordpress wordpress — From 5.6 (including) to 5.6.23 (excluding)
  • wordpress wordpress — From 5.7 (including) to 5.7.21 (excluding)
  • wordpress wordpress — From 5.8 (including) to 5.8.19 (excluding)
  • wordpress wordpress — From 5.9 (including) to 5.9.20 (excluding)
  • wordpress wordpress — From 6.0 (including) to 6.0.18 (excluding)
  • wordpress wordpress — From 6.1 (including) to 6.1.16 (excluding)
  • wordpress wordpress — From 6.2 (including) to 6.2.15 (excluding)
  • wordpress wordpress — From 6.3 (including) to 6.3.14 (excluding)
  • wordpress wordpress — From 6.4 (including) to 6.4.14 (excluding)
  • wordpress wordpress — From 6.5 (including) to 6.5.14 (excluding)
  • wordpress wordpress — From 6.6 (including) to 6.6.11 (excluding)
  • wordpress wordpress — From 6.7 (including) to 6.7.11 (excluding)
  • wordpress wordpress — From 6.8 (including) to 6.8.12 (excluding)
  • wordpress wordpress — From 6.9 (including) to 6.9.11 (excluding)
  • wordpress wordpress — From 7.0 (including) to 7.0.8 (excluding)
  • wordpress wordpress — From 7.1 (including) to 7.1.4 (excluding)

References

  • core.trac.wordpress.org https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162 Product
  • core.trac.wordpress.org https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378 Product
  • core.trac.wordpress.org https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549 Product
  • core.trac.wordpress.org https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282 Product
  • core.trac.wordpress.org https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346 Patch
  • core.trac.wordpress.org https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545 Patch
  • wordpress.org https://wordpress.org/news/2026/10/wordpress-7-1-4/ Release Notes
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve Third Party Advisory
  • www.cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977 US Government Resource
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution Third Party Advisory
  • nvd.nist.gov Official NVD record