CVE-2026-119977: listed in the CISA KEV catalog

CVE-2026-119977 · CVSS 8.1 HIGH · EPSS 1% · KEV 2026-11-03

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Is CVE-2026-119977 exploited?

• Listed in the CISA KEV catalog on 2026-11-03.
• Federal remediation due 2026-11-06.
• EPSS puts exploitation in the next 30 days at 1%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• WordPress Foundation · WordPress · 4.7.0 - 4.7.38, 4.8.0 - 4.8.33, 4.9.0 - 4.9.34, 5.0.0 - 5.0.30, 5.1.0 - 5.1.27, 5.2.0 - 5.2.29, +19 more

Is there a patch?

WordPress Foundation's record doesn't name a fixed version.

What PlainSec published about CVE-2026-119977

• WordPress upgrade window opens a path to server code (2026-11-04)

Primary sources

• NVD record
• CISA KEV catalog

What this record does not say

• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-11-04.