CVE-2026-119977: RCE during WordPress Core upgrade

WordPress Core (versions 4.7 through 7.1.3) is vulnerable to Remote Code Execution (CVE-2026-119977) during full-package upgrade process. The flaw exploits predictable, web-accessible staging paths: during upgrade, the server exposes foreseeable directories containing code under installation. Unauthenticated attackers can access these paths and execute arbitrary code on the server, gaining full control of the WordPress instance.

CVSS score is 8.1 (HIGH severity): this is an unauthenticated Remote Code Execution, the highest level of server compromise. The vulnerability was published on NVD on October 31, 2026. No public exploit has been reported on GitHub. Critical factor: as of now, no official patch has been released by the WordPress project.

For defense, immediate actions are: (1) postpone WordPress updates until an official patch is released; (2) restrict web access to staging paths, typically under wp-content/upgrade; (3) monitor access logs carefully for attempts to reach predictable staging directories; (4) if available, implement a WAF configured to block unauthorized access to known paths during maintenance windows.

If it is not possible to avoid update in the short term, DevOps and sysadmin teams should evaluate alternatives such as isolated staging environments, forced offline updates if possible, or reverse proxy architectures that hide sensitive paths.