{"history":[{"alert":0,"cve":"CVE-2026-119977","id":23134,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.01199, \"percentile\": 0.68599}"},{"alert":0,"cve":"CVE-2026-119977","id":20724,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.01199, \"percentile\": 0.68421}"},{"alert":0,"cve":"CVE-2026-119977","id":18552,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.01199, \"percentile\": 0.68385}"},{"alert":0,"cve":"CVE-2026-119977","id":16620,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.01157, \"percentile\": 0.67278}"},{"alert":0,"cve":"CVE-2026-119977","id":14598,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.01157, \"percentile\": 0.67258}"},{"alert":0,"cve":"CVE-2026-119977","id":12380,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.01157, \"percentile\": 0.67209}"},{"alert":0,"cve":"CVE-2026-119977","id":10367,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.01157, \"percentile\": 0.67184}"},{"alert":1,"cve":"CVE-2026-119977","id":8302,"kind":"cna","observed_at":1793852400,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-119977\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-11-03T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-11-03\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-04T04:56:31.158Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"third-party-advisory\"], \"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution\"}, {\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-11-03T00:00:00.000Z\", \"value\": \"CVE-2026-119977 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"WordPress\", \"vendor\": \"WordPress Foundation\", \"versions\": [{\"lessThanOrEqual\": \"4.7.38\", \"status\": \"affected\", \"version\": \"4.7.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"4.8.33\", \"status\": \"affected\", \"version\": \"4.8.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"4.9.34\", \"status\": \"affected\", \"version\": \"4.9.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.0.30\", \"status\": \"affected\", \"version\": \"5.0.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.1.27\", \"status\": \"affected\", \"version\": \"5.1.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.2.29\", \"status\": \"affected\", \"version\": \"5.2.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.3.26\", \"status\": \"affected\", \"version\": \"5.3.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.4.24\", \"status\": \"affected\", \"version\": \"5.4.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.5.23\", \"status\": \"affected\", \"version\": \"5.5.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.6.22\", \"status\": \"affected\", \"version\": \"5.6.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.7.20\", \"status\": \"affected\", \"version\": \"5.7.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.8.18\", \"status\": \"affected\", \"version\": \"5.8.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.9.19\", \"status\": \"affected\", \"version\": \"5.9.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.0.17\", \"status\": \"affected\", \"version\": \"6.0.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.1.15\", \"status\": \"affected\", \"version\": \"6.1.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.2.14\", \"status\": \"affected\", \"version\": \"6.2.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.3.13\", \"status\": \"affected\", \"version\": \"6.3.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.4.13\", \"status\": \"affected\", \"version\": \"6.4.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.5.13\", \"status\": \"affected\", \"version\": \"6.5.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.6.10\", \"status\": \"affected\", \"version\": \"6.6.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.7.10\", \"status\": \"affected\", \"version\": \"6.7.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.8.11\", \"status\": \"affected\", \"version\": \"6.8.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.9.10\", \"status\": \"affected\", \"version\": \"6.9.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"7.0.7\", \"status\": \"affected\", \"version\": \"7.0.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"7.1.3\", \"status\": \"affected\", \"version\": \"7.1.0\", \"versionType\": \"semver\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Umut Bayram\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.\"}], \"metrics\": [{\"cvssV3_1\": {\"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-367\", \"description\": \"CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-10-31T05:33:07.059Z\", \"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\"}, \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545\"}, {\"url\": \"https://wordpress.org/news/2026/10/wordpress-7-1-4/\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-10-28T00:00:00.000Z\", \"value\": \"Disclosed\"}], \"title\": \"WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution\"}}, \"cveMetadata\": {\"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"assignerShortName\": \"Wordfence\", \"cveId\": \"CVE-2026-119977\", \"datePublished\": \"2026-10-31T05:33:07.059Z\", \"dateReserved\": \"2026-10-30T17:17:35.145Z\", \"dateUpdated\": \"2026-11-04T04:56:31.158Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":1,"cve":"CVE-2026-119977","id":7917,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.0102, \"percentile\": 0.63514}"},{"alert":0,"cve":"CVE-2026-119977","id":6067,"kind":"epss","observed_at":1793744401,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.006, \"percentile\": 0.48751}"},{"alert":1,"cve":"CVE-2026-119977","id":5947,"kind":"cna","observed_at":1793744401,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-119977\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-11-03T20:50:05.434105Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-11-03\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-03T20:58:23.478Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"third-party-advisory\"], \"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution\"}, {\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-11-03T00:00:00.000Z\", \"value\": \"CVE-2026-119977 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"WordPress\", \"vendor\": \"WordPress Foundation\", \"versions\": [{\"lessThanOrEqual\": \"4.7.38\", \"status\": \"affected\", \"version\": \"4.7.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"4.8.33\", \"status\": \"affected\", \"version\": \"4.8.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"4.9.34\", \"status\": \"affected\", \"version\": \"4.9.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.0.30\", \"status\": \"affected\", \"version\": \"5.0.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.1.27\", \"status\": \"affected\", \"version\": \"5.1.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.2.29\", \"status\": \"affected\", \"version\": \"5.2.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.3.26\", \"status\": \"affected\", \"version\": \"5.3.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.4.24\", \"status\": \"affected\", \"version\": \"5.4.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.5.23\", \"status\": \"affected\", \"version\": \"5.5.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.6.22\", \"status\": \"affected\", \"version\": \"5.6.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.7.20\", \"status\": \"affected\", \"version\": \"5.7.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.8.18\", \"status\": \"affected\", \"version\": \"5.8.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"5.9.19\", \"status\": \"affected\", \"version\": \"5.9.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.0.17\", \"status\": \"affected\", \"version\": \"6.0.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.1.15\", \"status\": \"affected\", \"version\": \"6.1.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.2.14\", \"status\": \"affected\", \"version\": \"6.2.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.3.13\", \"status\": \"affected\", \"version\": \"6.3.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.4.13\", \"status\": \"affected\", \"version\": \"6.4.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.5.13\", \"status\": \"affected\", \"version\": \"6.5.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.6.10\", \"status\": \"affected\", \"version\": \"6.6.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.7.10\", \"status\": \"affected\", \"version\": \"6.7.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.8.11\", \"status\": \"affected\", \"version\": \"6.8.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.9.10\", \"status\": \"affected\", \"version\": \"6.9.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"7.0.7\", \"status\": \"affected\", \"version\": \"7.0.0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"7.1.3\", \"status\": \"affected\", \"version\": \"7.1.0\", \"versionType\": \"semver\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Umut Bayram\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.\"}], \"metrics\": [{\"cvssV3_1\": {\"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-367\", \"description\": \"CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-10-31T05:33:07.059Z\", \"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\"}, \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346\"}, {\"url\": \"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545\"}, {\"url\": \"https://wordpress.org/news/2026/10/wordpress-7-1-4/\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-10-28T00:00:00.000Z\", \"value\": \"Disclosed\"}], \"title\": \"WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution\"}}, \"cveMetadata\": {\"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"assignerShortName\": \"Wordfence\", \"cveId\": \"CVE-2026-119977\", \"datePublished\": \"2026-10-31T05:33:07.059Z\", \"dateReserved\": \"2026-10-30T17:17:35.145Z\", \"dateUpdated\": \"2026-11-03T20:58:23.478Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":1,"cve":"CVE-2026-119977","id":5946,"kind":"kev","observed_at":1793744401,"payload":"{\"cveID\": \"CVE-2026-119977\", \"cwes\": [\"CWE-367\"], \"dateAdded\": \"2026-11-03\", \"dueDate\": \"2026-11-06\", \"forensicTriage\": \"Yes\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://wordpress.org/news/2026/10/wordpress-7-1-4 ; https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-119977\", \"product\": \"WordPress Core\", \"requiredAction\": \"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\\u2019s \\u201cForensics Triage Requirements\\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.\", \"shortDescription\": \"WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.\", \"vendorProject\": \"WordPress\", \"vulnerabilityName\": \"WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability\"}"}],"record":{"affected":[{"defaultStatus":"unaffected","product":"WordPress","vendor":"WordPress Foundation","versions":[{"lessThanOrEqual":"4.7.38","status":"affected","version":"4.7.0","versionType":"semver"},{"lessThanOrEqual":"4.8.33","status":"affected","version":"4.8.0","versionType":"semver"},{"lessThanOrEqual":"4.9.34","status":"affected","version":"4.9.0","versionType":"semver"},{"lessThanOrEqual":"5.0.30","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThanOrEqual":"5.1.27","status":"affected","version":"5.1.0","versionType":"semver"},{"lessThanOrEqual":"5.2.29","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThanOrEqual":"5.3.26","status":"affected","version":"5.3.0","versionType":"semver"},{"lessThanOrEqual":"5.4.24","status":"affected","version":"5.4.0","versionType":"semver"},{"lessThanOrEqual":"5.5.23","status":"affected","version":"5.5.0","versionType":"semver"},{"lessThanOrEqual":"5.6.22","status":"affected","version":"5.6.0","versionType":"semver"},{"lessThanOrEqual":"5.7.20","status":"affected","version":"5.7.0","versionType":"semver"},{"lessThanOrEqual":"5.8.18","status":"affected","version":"5.8.0","versionType":"semver"},{"lessThanOrEqual":"5.9.19","status":"affected","version":"5.9.0","versionType":"semver"},{"lessThanOrEqual":"6.0.17","status":"affected","version":"6.0.0","versionType":"semver"},{"lessThanOrEqual":"6.1.15","status":"affected","version":"6.1.0","versionType":"semver"},{"lessThanOrEqual":"6.2.14","status":"affected","version":"6.2.0","versionType":"semver"},{"lessThanOrEqual":"6.3.13","status":"affected","version":"6.3.0","versionType":"semver"},{"lessThanOrEqual":"6.4.13","status":"affected","version":"6.4.0","versionType":"semver"},{"lessThanOrEqual":"6.5.13","status":"affected","version":"6.5.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"},{"lessThanOrEqual":"6.7.10","status":"affected","version":"6.7.0","versionType":"semver"},{"lessThanOrEqual":"6.8.11","status":"affected","version":"6.8.0","versionType":"semver"},{"lessThanOrEqual":"6.9.10","status":"affected","version":"6.9.0","versionType":"semver"},{"lessThanOrEqual":"7.0.7","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThanOrEqual":"7.1.3","status":"affected","version":"7.1.0","versionType":"semver"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-119977","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-11-03","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-11-04T04:56:31.158Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["third-party-advisory"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution"},{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977"}],"timeline":[{"lang":"en","time":"2026-11-03T00:00:00.000Z","value":"CVE-2026-119977 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"WordPress","vendor":"WordPress Foundation","versions":[{"lessThanOrEqual":"4.7.38","status":"affected","version":"4.7.0","versionType":"semver"},{"lessThanOrEqual":"4.8.33","status":"affected","version":"4.8.0","versionType":"semver"},{"lessThanOrEqual":"4.9.34","status":"affected","version":"4.9.0","versionType":"semver"},{"lessThanOrEqual":"5.0.30","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThanOrEqual":"5.1.27","status":"affected","version":"5.1.0","versionType":"semver"},{"lessThanOrEqual":"5.2.29","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThanOrEqual":"5.3.26","status":"affected","version":"5.3.0","versionType":"semver"},{"lessThanOrEqual":"5.4.24","status":"affected","version":"5.4.0","versionType":"semver"},{"lessThanOrEqual":"5.5.23","status":"affected","version":"5.5.0","versionType":"semver"},{"lessThanOrEqual":"5.6.22","status":"affected","version":"5.6.0","versionType":"semver"},{"lessThanOrEqual":"5.7.20","status":"affected","version":"5.7.0","versionType":"semver"},{"lessThanOrEqual":"5.8.18","status":"affected","version":"5.8.0","versionType":"semver"},{"lessThanOrEqual":"5.9.19","status":"affected","version":"5.9.0","versionType":"semver"},{"lessThanOrEqual":"6.0.17","status":"affected","version":"6.0.0","versionType":"semver"},{"lessThanOrEqual":"6.1.15","status":"affected","version":"6.1.0","versionType":"semver"},{"lessThanOrEqual":"6.2.14","status":"affected","version":"6.2.0","versionType":"semver"},{"lessThanOrEqual":"6.3.13","status":"affected","version":"6.3.0","versionType":"semver"},{"lessThanOrEqual":"6.4.13","status":"affected","version":"6.4.0","versionType":"semver"},{"lessThanOrEqual":"6.5.13","status":"affected","version":"6.5.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"},{"lessThanOrEqual":"6.7.10","status":"affected","version":"6.7.0","versionType":"semver"},{"lessThanOrEqual":"6.8.11","status":"affected","version":"6.8.0","versionType":"semver"},{"lessThanOrEqual":"6.9.10","status":"affected","version":"6.9.0","versionType":"semver"},{"lessThanOrEqual":"7.0.7","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThanOrEqual":"7.1.3","status":"affected","version":"7.1.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Umut Bayram"}],"descriptions":[{"lang":"en","value":"WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window."}],"metrics":[{"cvssV3_1":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-367","description":"CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-31T05:33:07.059Z","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence"},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346"},{"url":"https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545"},{"url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/"}],"timeline":[{"lang":"en","time":"2026-10-28T00:00:00.000Z","value":"Disclosed"}],"title":"WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution"}},"cveMetadata":{"assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","assignerShortName":"Wordfence","cveId":"CVE-2026-119977","datePublished":"2026-10-31T05:33:07.059Z","dateReserved":"2026-10-30T17:17:35.145Z","dateUpdated":"2026-11-04T04:56:31.158Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794457201,"cve":"CVE-2026-119977","description":"WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.","epss":{"date":"2026-11-12","epss":0.01199,"percentile":0.68599},"epss_checked":1794522003,"first_seen":1793744401,"kev":{"cveID":"CVE-2026-119977","cwes":["CWE-367"],"dateAdded":"2026-11-03","dueDate":"2026-11-06","forensicTriage":"Yes","knownRansomwareCampaignUse":"Unknown","notes":"https://wordpress.org/news/2026/10/wordpress-7-1-4 ; https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-119977","product":"WordPress Core","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","shortDescription":"WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.","vendorProject":"WordPress","vulnerabilityName":"WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability"},"kev_checked":1794522003,"products":"WordPress Foundation WordPress","references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve","https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378","https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162","https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549","https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282","https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346","https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545","https://wordpress.org/news/2026/10/wordpress-7-1-4/","https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977"],"score":{"baseScore":8.1,"baseSeverity":"HIGH","provider":"Wordfence","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977","id":181,"publisher":"CISA KEV","title":"WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability"},{"canonical_url":"https://xakep.ru/2026/11/09/cve-2026-119977/","id":293,"publisher":"Xakep","title":"RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 WordPress \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438"}]}