CVE-2026-119977CVSS 8.1Unauthenticated staged-installer race
An attacker can run server code by reaching temporary installer files before update cleanup; no account is required.
WordPress patches upgrade-window RCE as attackers probe staged installers
WordPress 7.1.4 fixes an unauthenticated upgrade-window RCE and other security issues. Wordfence observes exploitation attempts, not confirmed successful intrusions; the RCE needs a full-package update and publicly executable staging files.
- Disclosed
- Oct 28, 2026
- Public disclosure date
- Severity
- CVSS 8.1
- 1 CVE tracked here
- Splash zone
- Unpatched WordPress 4.7–7.1.3 during full-package updates with a web-accessible, PHP-executable staging tree
- php
- In the wild
- Yes
- Wordfence reports active attempts; successful intrusions are not established.
What happened
The October 28 release groups stored XSS, Interactivity API, disclosure and authorization fixes with the installer race and a certificate-trust update. Their permissions and affected branches differ; the unauthenticated RCE prerequisite must not be applied to every sibling issue.
The attacker must locate the temporary tree and finish before cleanup, typically seconds in Wordfence’s testing. An idle WordPress installation is not continuously exposed through this race. L4 reflects active targeting of a widely deployed platform, not a demonstrated mass compromise. No victim count is established.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| WordPress 7.1 | 7.1.4 | |
| WordPress 7.0 | 7.0.8 | |
| WordPress 6.9 | 6.9.11 | |
| WordPress 6.8 | 6.8.12 | |
| WordPress 6.7 | 6.7.11 | |
| WordPress 6.6 | 6.6.11 | |
| WordPress 6.5 | 6.5.14 | |
| WordPress 6.4 | 6.4.14 | |
| WordPress 6.3 | 6.3.14 | |
| WordPress 6.2 | 6.2.15 | |
| WordPress 6.1 | 6.1.16 | |
| WordPress 6.0 | 6.0.18 | |
| WordPress 5.9 | 5.9.20 | |
| WordPress 5.8 | 5.8.19 | |
| WordPress 5.7 | 5.7.21 | |
| WordPress 5.6 | 5.6.23 | |
| WordPress 5.5 | 5.5.24 | |
| WordPress 5.4 | 5.4.25 | |
| WordPress 5.3 | 5.3.27 | |
| WordPress 5.2 | 5.2.30 | |
| WordPress 5.1 | 5.1.28 | |
| WordPress 5.0 | 5.0.31 | |
| WordPress 4.9 | 4.9.35 | |
| WordPress 4.8 | 4.8.34 | |
| WordPress 4.7 | 4.7.39 | |
| WordPress 4.6 and earlier | No fix | No security updates; migrate |
Crime-scene timeline
Oct 28, 2026
WordPress publishes the security release
Oct 29, 2026
Wordfence reports staged-installer exploitation attempts
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.