All vulnerabilities

WordPress core

CVE-2026-119977

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

Severity: High 8.1
Published: 31 Oct 2026
Last changed: 31 Oct 2026
Added to UpHeron: 31 Oct 2026
Sources: CVE Program

Affected software

Software Affected versions

WordPressWordPress core · cna:wordpress foundation|wordpress

From 7.1.0 up to 7.1.3
From 7.0.0 up to 7.0.7
From 6.9.0 up to 6.9.10
From 6.8.0 up to 6.8.11

All 25 release lines

From 4.7.0 up to 4.7.38
From 4.8.0 up to 4.8.33
From 4.9.0 up to 4.9.34
From 5.0.0 up to 5.0.30
From 5.1.0 up to 5.1.27
From 5.2.0 up to 5.2.29
From 5.3.0 up to 5.3.26
From 5.4.0 up to 5.4.24
From 5.5.0 up to 5.5.23
From 5.6.0 up to 5.6.22
From 5.7.0 up to 5.7.20
From 5.8.0 up to 5.8.18
From 5.9.0 up to 5.9.19
From 6.0.0 up to 6.0.17
From 6.1.0 up to 6.1.15
From 6.2.0 up to 6.2.14
From 6.3.0 up to 6.3.13
From 6.4.0 up to 6.4.13
From 6.5.0 up to 6.5.13
From 6.6.0 up to 6.6.10
From 6.7.0 up to 6.7.10
From 6.8.0 up to 6.8.11
From 6.9.0 up to 6.9.10
From 7.0.0 up to 7.0.7
From 7.1.0 up to 7.1.3

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-119977