Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-119977

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.012
EPSS Ranking 67.3%
CVSS Severity
CVSS v3 Score 8.1
Proposed Action
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
Ransomware Campaign
Unknown
References
Products affected by CVE-2026-119977


Contact Us

Shodan ® - All rights reserved