Predictable staging paths let attackers run code in WordPress Core
Priority CRITICAL 94Exploited in the wildCWE-367Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
WordPress Core versions 4.7 through 7.1.3 are affected. Full-package core upgrades use predictable, web-accessible staging paths (CWE-367), which lets an unauthenticated remote attacker execute code on the server during the upgrade window. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-03.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Why it matters now
Exploitation Active In CISA KEV since 2026-11-03CISA due date 2026-11-06
EPSS 0.01157 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WordPress | WordPress | 4.7.0 – 4.7.38; 4.8.0 – 4.8.33; 4.9.0 – 4.9.34; 5.0.0 – 5.0.30; 5.1.0 – 5.1.27; 5.2.0 – 5.2.29; 5.3.0 – 5.3.26; 5.4.0 – 5.4.24; 5.5.0 – 5.5.23; 5.6.0 – 5.6.22; 5.7.0 – 5.7.20; 5.8.0 – 5.8.18; 5.9.0 – 5.9.19; 6.0.0 – 6.0.17; 6.1.0 – 6.1.15; 6.2.0 – 6.2.14; 6.3.0 – 6.3.13; 6.4.0 – 6.4.13; 6.5.0 – 6.5.13; 6.6.0 – 6.6.10; 6.7.0 – 6.7.10; 6.8.0 – 6.8.11; 6.9.0 – 6.9.10; 7.0.0 – 7.0.7; 7.1.0 – 7.1.3 | — | No fix listed | CNA |
- WordPress VendorWordPress Affected 4.7.0 – 4.7.38; 4.8.0 – 4.8.33; 4.9.0 – 4.9.34; 5.0.0 – 5.0.30; 5.1.0 – 5.1.27; 5.2.0 – 5.2.29; 5.3.0 – 5.3.26; 5.4.0 – 5.4.24; 5.5.0 – 5.5.23; 5.6.0 – 5.6.22; 5.7.0 – 5.7.20; 5.8.0 – 5.8.18; 5.9.0 – 5.9.19; 6.0.0 – 6.0.17; 6.1.0 – 6.1.15; 6.2.0 – 6.2.14; 6.3.0 – 6.3.13; 6.4.0 – 6.4.13; 6.5.0 – 6.5.13; 6.6.0 – 6.6.10; 6.7.0 – 6.7.10; 6.8.0 – 6.8.11; 6.9.0 – 6.9.10; 7.0.0 – 7.0.7; 7.1.0 – 7.1.3 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* | 4.7 to before 4.7.39; 4.8 to before 4.8.34; 4.9 to before 4.9.35; 5.0 to before 5.0.31; 5.1 to before 5.1.28; 5.2 to before 5.2.30; 5.3 to before 5.3.27; 5.4 to before 5.4.25; 5.5 to before 5.5.24; 5.6 to before 5.6.23; 5.7 to before 5.7.21; 5.8 to before 5.8.19; 5.9 to before 5.9.20; 6.0 to before 6.0.18; 6.1 to before 6.1.16; 6.2 to before 6.2.15; 6.3 to before 6.3.14; 6.4 to before 6.4.14; 6.5 to before 6.5.14; 6.6 to before 6.6.11; 6.7 to before 6.7.11; 6.8 to before 6.8.12; 6.9 to before 6.9.11; 7.0 to before 7.0.8; 7.1 to before 7.1.4 | Vulnerable | WordPress |
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* Versions 4.7 to before 4.7.39; 4.8 to before 4.8.34; 4.9 to before 4.9.35; 5.0 to before 5.0.31; 5.1 to before 5.1.28; 5.2 to before 5.2.30; 5.3 to before 5.3.27; 5.4 to before 5.4.25; 5.5 to before 5.5.24; 5.6 to before 5.6.23; 5.7 to before 5.7.21; 5.8 to before 5.8.19; 5.9 to before 5.9.20; 6.0 to before 6.0.18; 6.1 to before 6.1.16; 6.2 to before 6.2.15; 6.3 to before 6.3.14; 6.4 to before 6.4.14; 6.5 to before 6.5.14; 6.6 to before 6.6.11; 6.7 to before 6.7.11; 6.8 to before 6.8.12; 6.9 to before 6.9.11; 7.0 to before 7.0.8; 7.1 to before 7.1.4 Vulnerable ·WordPress
Remediation
The sources list no fixed version for WordPress. CISA set a KEV due date of 2026-11-06.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Vendor assessments
Timeline
- 2026-10-31 Threatist record created from CVE-2026-119977
- 2026-10-31 Alias added: GHSA-p6jj-qrp3-7m4g
- 2026-11-01 Priority changed: MEDIUM → LOW
- 2026-11-02 Affected versions changed · Red Hat
- 2026-11-02 CVSS score added · Red Hat
- 2026-11-03 Added to CISA KEV
- 2026-11-03 Priority changed: LOW → CRITICAL
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-04 EPSS moved to the 50th–90th percentile
- 2026-11-04 CISA SSVC decision points changed
References
Patch 2
Advisory 2
Other 5
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549
- https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282
- https://wordpress.org/news/2026/10/wordpress-7-1-4/
More Wordpress vulnerabilities
- TI-2026-45010 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution KEVCVSS 3.1CRITICAL 9.8
- TI-2016-08118 The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-59973 An unauthenticated attacker can make `get_page_template()` page-template resolution… KEVCVSS 3.1HIGH 8.1
- TI-2016-08129 The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass… CVSS 3.1CRITICAL 9.8
- TI-2026-42844 WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query KEVCVSS 3.1MEDIUM 5.9
- TI-2022-06039 SQL injection in WordPress CVSS 3.1HIGH 8.0
Sources
- CVE-2026-119977 · CVE Program
- CVE-2026-119977 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-p6jj-qrp3-7m4g · GitHub Advisory Database · CC BY 4.0
- CVE-2026-119977 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences