WordPress Core unauthenticated remote code execution during upgrade window (CVE-2026-119977)

What happened

WordPress Core has a time-of-check/time-of-use weakness (CWE-367) in the full-package upgrade process. During an upgrade, WordPress uses staging paths that are predictable and reachable over the web. An unauthenticated attacker who can reach the site during that upgrade window can execute code on the server, without needing credentials or user interaction.

The CVSS 3.1 score is 8.1, high severity, with a network attack vector, high attack complexity and no privileges or user interaction required. A successful compromise has high impact on confidentiality, integrity and availability.

No exploitation is recorded in the CVE record, and the record does not indicate public disclosure.

Who is affected

The CVE description states that WordPress Core versions 4.7 through 7.1.3 are vulnerable. The affected version ranges listed in the record are: 4.7.0 to 4.7.38, 4.8.0 to 4.8.33, 4.9.0 to 4.9.34, 5.0.0 to 5.0.30, 5.1.0 to 5.1.27, 5.2.0 to 5.2.29, 5.3.0 to 5.3.26, and 5.4.0 to 5.4.24. This is a core-platform issue, not a plugin or theme flaw. WordPress sites that perform full-package core upgrades while reachable from untrusted networks are the primary exposure.

What to do now

No fixed version is listed in this CVE record, and no workaround has been published. Until a fixed release is formally announced, take the following containment steps:

1. Avoid running full-package WordPress core upgrades while the site is reachable from untrusted networks. If an upgrade is necessary, run it from a maintenance context that isolates the site or take it offline first.
2. Restrict network access to the web server during scheduled upgrade windows, and limit who can initiate WordPress core updates.
3. Check the web-accessible staging paths used by the upgrader for unexpected files or requests during and after each upgrade.
4. Watch for a formal fixed release from WordPress and apply it when one is listed for your version.

How to detect it

No vendor indicators of compromise are available in the record. If you run full-package upgrades, treat requests to the upgrade staging paths from outside a planned maintenance window as suspicious, and review web server logs for access to those paths.

Beyond the patch

Because this is a core-platform issue with no fixed version yet, visibility and hardening matter most. A penetration test and hardening review through Implementation & Assessment Services can map where WordPress is exposed and how upgrade staging paths are handled, and Managed Detection & Response can monitor for the post-exploitation activity that successful code execution leaves behind.