CVE-2026-119977 in WordPress
Summary
by MITRE • 10/31/2026
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified as CVE-2024-something (specifically affecting WordPress Core versions 4.7 through 7.1.3) represents a critical Remote Code Execution flaw rooted in improper handling of file system paths during core update procedures. This security defect arises from the predictable and publicly accessible nature of staging directories created by the WordPress upgrade mechanism. When an administrator initiates a full-package core upgrade, the system creates temporary directories to store the new version files before replacing the existing installation. These staging paths are generated using deterministic logic that does not incorporate sufficient randomness or secrecy, allowing external actors to anticipate their exact location on the web server's file structure.
From a technical perspective, this flaw is classified under CWE-376: Improper Handling of Temporary Files and Directories. The core issue lies in the lack of access controls for these temporary staging directories during the brief window when they exist prior to being overwritten or deleted by the successful upgrade process. Because the path structure follows a predictable pattern based on version numbers and timestamps, an unauthenticated attacker can calculate the URL leading to this directory. By uploading malicious PHP scripts or other executable content into this location via standard upload mechanisms or direct HTTP requests if permitted, the attacker gains a foothold within the server's execution context.
The operational impact of this vulnerability is severe due to its potential for Remote Code Execution without authentication. Attackers can exploit this during the upgrade window, which typically lasts only minutes but provides a sufficient opportunity for automated scanning tools and malicious actors to detect active upgrades and launch attacks. Once code is executed within the staging directory, it runs with the same privileges as the web server process. This allows attackers to achieve full control over the compromised system, including reading sensitive configuration files such as wp-config.php which contains database credentials, modifying site content, installing persistent backdoors, or pivoting to other systems on the internal network.
This vulnerability aligns with MITRE ATT&CK technique T1505.003: Web Shell, where attackers deploy a web shell to maintain access and execute commands remotely. It also relates to T1190: Exploit Public-Facing Application, as it targets a widely deployed internet-facing service. The predictability of the path makes this vulnerability particularly dangerous because it can be automated at scale across thousands of WordPress installations that are currently undergoing updates.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary defense is to upgrade WordPress Core immediately to version 7.1.4 or later, where the staging directory handling has been corrected to prevent predictable path exposure. For sites unable to update instantly due to compatibility concerns with plugins or themes, administrators should implement web application firewall rules that block access to known vulnerable staging paths if they can be identified by pattern matching on live systems. Additionally, restricting file upload permissions and ensuring that temporary directories are not publicly accessible via HTTP requests is crucial. Regular monitoring of server logs for unusual activity during upgrade windows can also help detect exploitation attempts in real time.