{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-09T07:20:08.601","vulnerabilities":[{"cve":{"id":"CVE-2026-119977","sourceIdentifier":"security@wordfence.com","published":"2026-10-31T06:16:34.550","lastModified":"2026-11-04T12:52:38.683","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"WordPress Foundation","product":"WordPress","defaultStatus":"unaffected","versions":[{"version":"4.7.0","lessThanOrEqual":"4.7.38","versionType":"semver","status":"affected"},{"version":"4.8.0","lessThanOrEqual":"4.8.33","versionType":"semver","status":"affected"},{"version":"4.9.0","lessThanOrEqual":"4.9.34","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThanOrEqual":"5.0.30","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThanOrEqual":"5.1.27","versionType":"semver","status":"affected"},{"version":"5.2.0","lessThanOrEqual":"5.2.29","versionType":"semver","status":"affected"},{"version":"5.3.0","lessThanOrEqual":"5.3.26","versionType":"semver","status":"affected"},{"version":"5.4.0","lessThanOrEqual":"5.4.24","versionType":"semver","status":"affected"},{"version":"5.5.0","lessThanOrEqual":"5.5.23","versionType":"semver","status":"affected"},{"version":"5.6.0","lessThanOrEqual":"5.6.22","versionType":"semver","status":"affected"},{"version":"5.7.0","lessThanOrEqual":"5.7.20","versionType":"semver","status":"affected"},{"version":"5.8.0","lessThanOrEqual":"5.8.18","versionType":"semver","status":"affected"},{"version":"5.9.0","lessThanOrEqual":"5.9.19","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThanOrEqual":"6.0.17","versionType":"semver","status":"affected"},{"version":"6.1.0","lessThanOrEqual":"6.1.15","versionType":"semver","status":"affected"},{"version":"6.2.0","lessThanOrEqual":"6.2.14","versionType":"semver","status":"affected"},{"version":"6.3.0","lessThanOrEqual":"6.3.13","versionType":"semver","status":"affected"},{"version":"6.4.0","lessThanOrEqual":"6.4.13","versionType":"semver","status":"affected"},{"version":"6.5.0","lessThanOrEqual":"6.5.13","versionType":"semver","status":"affected"},{"version":"6.6.0","lessThanOrEqual":"6.6.10","versionType":"semver","status":"affected"},{"version":"6.7.0","lessThanOrEqual":"6.7.10","versionType":"semver","status":"affected"},{"version":"6.8.0","lessThanOrEqual":"6.8.11","versionType":"semver","status":"affected"},{"version":"6.9.0","lessThanOrEqual":"6.9.10","versionType":"semver","status":"affected"},{"version":"7.0.0","lessThanOrEqual":"7.0.7","versionType":"semver","status":"affected"},{"version":"7.1.0","lessThanOrEqual":"7.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-03T00:00:00+00:00","id":"CVE-2026-119977","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-11-03","cisaActionDue":"2026-11-06","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability","weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"4.7.39","matchCriteriaId":"F9A3BB19-029C-4289-9D7E-3AAED10673D6"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"4.8.34","matchCriteriaId":"9998D1B3-DEF0-4728-B2C4-D3D6792CDF0E"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9","versionEndExcluding":"4.9.35","matchCriteriaId":"4A996748-2A2D-48B9-8AB7-CB138018CD8A"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"5.0.31","matchCriteriaId":"1A8E7D30-6E7F-41A8-80DF-AF11BD6884C8"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"5.1.28","matchCriteriaId":"2C1E9F24-71B2-46E4-B24D-EA10E298D1AC"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"5.2.30","matchCriteriaId":"7EF4C0E7-7A64-4270-96C7-C0BD05F3FCDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"5.3.27","matchCriteriaId":"3C86DD96-D9A4-45AA-81A6-5695AA08A689"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"5.4.25","matchCriteriaId":"A46E8759-8A85-414F-9C46-A34BC060C111"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.5.24","matchCriteriaId":"01531FD1-8548-4949-8256-E10A8FAFC3B5"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.6.23","matchCriteriaId":"778551C7-722F-4366-9D86-736A924C6062"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.7.21","matchCriteriaId":"B4D242D6-693F-4338-AB59-0FB4C2EC01F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"5.8.19","matchCriteriaId":"72DFACDD-FAE4-4DD5-A1A3-57C0597251D3"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"5.9","versionEndExcluding":"5.9.20","matchCriteriaId":"3BE2DE77-1F2A-40F7-8DE9-EEE29D883337"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.0.18","matchCriteriaId":"C52767EC-E4F4-4F16-9BE7-2CE4495C9BE7"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1","versionEndExcluding":"6.1.16","matchCriteriaId":"F5E86746-433B-4158-95CE-8B58F37CDD69"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.2.15","matchCriteriaId":"DE25F568-450E-4A22-8632-523712F46194"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.3.14","matchCriteriaId":"314E0CC8-537E-4BF4-9CBC-6BC455B258A6"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.4.14","matchCriteriaId":"D7853BDB-8F3A-4019-B0EB-E5D1A9CB3AB4"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"6.5.14","matchCriteriaId":"A52505F2-B26E-4831-AD05-2F0905F85CDB"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.11","matchCriteriaId":"B2A16228-BBEF-467D-B934-6A4CE0308E20"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.7.11","matchCriteriaId":"9E165096-E752-4DC2-8666-830F87725FDC"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.8.12","matchCriteriaId":"903E5D89-7D08-4232-887B-6874DCB17070"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.9.11","matchCriteriaId":"27559BDC-624A-4D07-BC9E-069CABCAE64C"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0","versionEndExcluding":"7.0.8","matchCriteriaId":"F5BD7802-3450-4A82-9960-23A8F85DB2D7"},{"vulnerable":true,"criteria":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.1.4","matchCriteriaId":"BF4C2627-2EF5-4D3B-B857-FC103D4E3E7E"}]}]}],"references":[{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162","source":"security@wordfence.com","tags":["Product"]},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378","source":"security@wordfence.com","tags":["Product"]},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549","source":"security@wordfence.com","tags":["Product"]},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282","source":"security@wordfence.com","tags":["Product"]},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346","source":"security@wordfence.com","tags":["Patch"]},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545","source":"security@wordfence.com","tags":["Patch"]},{"url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/","source":"security@wordfence.com","tags":["Release Notes"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve","source":"security@wordfence.com","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Third Party Advisory"]}]}}]}