WordPress core RCE under active attack; Wordfence blocks 58,693 attempts
CVE-2026-119977 in WordPress 4.7 through 7.1.3 can yield unauthenticated PHP execution during brief upgrades; 7.1.4 patches it.
78
CVE-2026-119977
Unauthenticated RCE in WordPress Core during upgrades
- CVSS 3.1
- 8.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
WordPress Core 4.7 through 7.1.3 uses predictable, web-accessible staging paths during full-package core upgrades (CWE-367). An unauthenticated attacker on the network can run code on the server, but only during that upgrade window and with high attack complexity. No fixed release is stated.
What to do: No fixed version is stated. Apply WordPress's update for CVE-2026-119977 when one is published.
| Product | Affected |
|---|---|
| WordPress Core | 4.7 through 7.1.3 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
- Ecosystems
- WordPress
- Weakness
- CWE-367
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H