CVE-2026-119977

HIGH8.1

CISA KEV

Published 2026-10-31 · Updated 2026-11-03 · Source security@wordfence.com

Summary

CVE-2026-119977 is a high-severity (CVSS 8.1) vulnerability in WordPress WordPress Core. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026, which means exploitation in the wild has been confirmed; US federal agencies must remediate it by November 6, 2026. CISA does not currently list it as used in ransomware campaigns. WordPress has 7 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 7 known-exploited WordPress vulnerabilities →

Description

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-367

CISA Known-Exploited Vulnerability

Product: WordPress — WordPress Core

Name: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

Date added: 2026-11-03 · Due: 2026-11-06

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

View on NVD

More exploited WordPress vulnerabilities

Most recently added to CISA KEV

CVE-2026-87902
Core — WordPress Core Remote File Inclusion Vulnerability
added 2026-09-25
CVE-2026-60137
Core — WordPress Core SQL Injection Vulnerability
added 2026-07-21
CVE-2026-63030
Core — WordPress Core Interpretation Conflict Vulnerability
added 2026-07-21
CVE-2020-25213
File Manager Plugin — WordPress File Manager Plugin Remote Code Execution Vulnerability
added 2021-11-03
CVE-2020-11738
Snap Creek Duplicator Plugin — WordPress Snap Creek Duplicator Plugin File Download Vulnerability
added 2021-11-03
CVE-2019-9978
Social Warfare Plugin — WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
added 2021-11-03

View all →

Related CVEs

Same severity, most recent

CVE-2026-121610
A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the component Frontend List Endpoint. The manipulation of the argument selectFields results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
2026-11-04 · score 7.3
CVE-2026-121608
A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manipulation of the argument tz can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.4.0 is able to resolve this issue. Upgrading the affected component is advised. Firmware 6.4.0 gates the path with a new check_timezone_parameter validation (verified by VulDB vulnerability analysis team via disassembly).
2026-11-04 · score 7.3
CVE-2026-92211
Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of USDC and USDZ files. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30428.
2026-11-04 · score 7.8
CVE-2026-92200
Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from incorrect permissions on a folder used by the product. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31118.
2026-11-04 · score 7.8
CVE-2026-92199
Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the symmetricDecrypt method. The issue results from the use of a hard-coded cryptographic key. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29967.
2026-11-04 · score 7.8