A recently disclosed vulnerability (CVE-2026-119977) affects WordPress Core and may allow unauthenticated remote attackers to execute arbitrary code on vulnerable web servers during a full-package core upgrade.
Severity level:
CVSS Score: 8.1/High
Description:
CVE-2026-119977 is a remote code execution vulnerability caused by predictable, web-accessible staging directories used by WordPress Core during full-package upgrades. An unauthenticated attacker who accesses the staging directory during the limited upgrade window may be able to interact with staged installation files and execute arbitrary code on the server.
Affected Versions:
- The vulnerability affects WordPress Core versions 4.7 through 7.1.3.
Impact:
Successful exploitation may allow attackers to execute arbitrary PHP code on the web server.
Resolution:
Update immediately to the applicable security release for the installed WordPress branch.
Reference:
https://www.cyber.gc.ca/en/alerts-advisories/wordpress-security-advisory-av26-1117
https://nvd.nist.gov/vuln/detail/cve-2026-119977
https://www.tenable.com/cve/CVE-2026-119977
UIT Information Security