CVE-2026-119977
High · 8.1 CISA KEVCVSS
8.1
EPSS
1.0%
Published
Oct 31, 2026
CISA due date
Nov 6, 2026
The record
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121245 Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-367
- CVE-2026-121050 Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a… CWE-367
- CVE-2026-121048 Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to… CWE-367
- CVE-2026-88968 Claude Code is an agentic coding tool. CWE-367
- CVE-2026-116250 In server mode pgAdmin 4 validates a path a user gives for a file in their storage… CWE-367
- CVE-2026-116240 In server mode pgAdmin 4 validates a path into the user's storage directory with… CWE-367
- CVE-2026-115683 A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate… CWE-367
- CVE-2026-119552 Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup… CWE-367