peter bassill · operator
$ cve CVE-2026-119977 JSON

CVE-2026-119977 KEV

8.1
HIGH · CVSS 3.1 · EPSS 0.6% (pctl 49)

Patch first

On CISA KEV — known exploited in the wild, due 2026-11-06.

Description

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Scoring

CVSS8.1 (HIGH, v3.1)
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.6% — more likely to be exploited than 49% of all CVEs
WeaknessCWE-367
On CISA KEVyes — remediate by 2026-11-06
Public exploitnone known
Published2026-10-31
Last modified2026-11-03

CISA KEV

NameWordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
Added2026-11-03
Due2026-11-06
Vendor / productWordPress / WordPress Core
Ransomware usenone reported

References

→ the Explorer  ·  watch your stack  ·  NVD