Skip to content
Sign in
CVE-2026-1199778.1High

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

WordPress · WordPress Core

Exploited in the wild · in CISA KEV since 3 NovVendor fix available
0.6%probability of exploitation in the next 30 days
48th percentile
050100

Higher than 48% of scored CVEs

8.1HighCVSS
LowHigh

Federal deadline

CISA KEV · added 3 Nov · catalogue entry

3d1h6mleft

First in our coverage 3 Nov (CISA), the day CISA added it to KEV.

NowAdded to CISA KEV3 Nov · cisa.govFirst in our coverage3 Nov · CISAFederal deadlineFri 6 Nov, 23:59 UTC
  • In CISA KEV
  • Remediation window
  • Article

DescriptionNVD

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Coverage1 article · 1 outlet

First in our coverage: CISA, 3 Nov.

  1. CISA Flags Exploited WordPress Flaw Allowing Unauthenticated Code Execution
    CISA · official notice · first in our coverage

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in