CVE-2026-119977

DSA-6596-1 wordpress - security update

wordpress

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

29. Okt 2026

Ausgewertete Quellen

• Debian
  DSA-6596-1 wordpress - security update
• Red Hat
  Red Hat
• Hinweis
  https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve
• Hinweis
  https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977
• CISA
  WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
• NVD
  CVE-2026-119977