WordPress Core RCE Vulnerability Allows Unauthenticated Remote Code Execution
Attackers exploit race condition in WordPress Core upgrades for unauthenticated RCE on versions 4.7 to 7.1.3.
70
Product
WordPress Core
- Mentions · 7d3
- Mentions · 30d13
- All mentions15
- First seenSep 19, 2026
- Last mentioned4d ago
Timeline
15 articles · newest firstWordfence logs 549 WordPress flaws, including core installer RCE
Seventeen were rated critical; 41 of 549 remain unpatched, and free firewall users get new rules after 30 days.
62
Attackers probe WordPress upgrade-window RCE, CVE-2026-119977
Wordfence blocked over 240,000 attempts; CISA added the flaw to KEV on November 2.
78
CISA flags WordPress RCE flaw as actively exploited in attacks
CISA added CVE-2026-119977 to its KEV catalog after attackers exploited the high-severity TOCTOU race condition in WordPress core upgrades.
90
CISA adds WordPress code execution vulnerability to KEV catalog
CVE-2026-119977 allows unauthenticated code execution during WordPress upgrades and is actively exploited.
75
CISA Adds WordPress Core Vulnerability to KEV Catalog
CVE-2026-119977 TOCTOU race condition enables unauthenticated remote code execution during upgrades.
75
CISA Adds WordPress Upgrade Flaw to KEV Catalog
CVE-2026-119977 allows remote code execution via race condition during WordPress upgrades.
85
CISA adds WordPress Core TOCTOU flaw to KEV
CISA confirms active exploitation of CVE-2026-119977 allowing unauthenticated code execution during upgrades.
85
CISA adds WordPress TOCTOU vulnerability to KEV Catalog
CISA adds CVE-2026-119977, a TOCTOU race condition in WordPress Core, to KEV Catalog based on active exploitation.
80
CISA KEV: WordPress Core TOCTOU race condition CVE-2026-119977
WordPress Core upgrade TOCTOU vulnerability enables unauthenticated code execution during staging.
85
Attackers probe WordPress core race; 62,969 attempts in a day
Unauthenticated attackers can reach the installer under wp-content/upgrade only while a full core package is unpacking.
78
WordPress update RCE attacked hours after the 7.1.4 patch
Wordfence logged more than 18,500 requests to temporary installer paths in 21 hours; Core 4.7 through 7.1.3 is affected.
84
WordPress 7.1.4 fixes unauthenticated upgrade-window RCE under attack
Core 4.7 through 7.1.3 is affected; attackers poll a seconds-long staging window during full updates.
84
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
A crafted comment (Comment2Shell) allowed an attacker to run code on the server via a line break in an HTML attribute. Another flaw, Click2Shell, enabled theme installation and further code execution. WordPress has had…
70
Click2Shell WordPress Flaw Lets Attackers Gain RCE With a Single Malicious Link
Researchers disclosed Click2Shell, a WordPress exploit chain that turns a single malicious link clicked by an admin into remote code execution; fixed in WordPress 7.1.1.
65
Related CVEs
by mentions- CVE-2026-1199771%8.1Unauthenticated RCE in WordPress Core during upgrades
- CVE-2026-93485<1%7.1Unauthenticated Stored DOM-Based XSS in WordPress Core Affecting 4.7–7.0
Appears with
- WordPressvendor · 13
- CISAorganization · 5
- Wordfenceproduct · 3
- Wordfenceorganization · 3
- WordPress serversvictim · 1
- a blogger named Swati Khandelwalvictim · 1
- Comment2Shellmalware · 1
- Click2Shellmalware · 1
- Wordfencevendor · 1
- Mobile Repair Zoneproduct · 1
- YOOOthemevendor · 1
- WordPress 4.7ai model · 1
- Patchstackvendor · 1
- a blogger named Swati Khandelwalorganization · 1
- WordPress.orgorganization · 1
- YOOOtheme Proproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.