Skip to content

CVE record · 1 source

CVE-2026-119977

CVSS 8.1

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3.

Vendor: WordPress Foundation
Product: WordPress
CVSS v3.1: 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-367
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

21

CVE NVD 30h ago

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3.

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated…

CVSS 8.1 CVE-2026-119977 WordPress Foundation