WordPress Core: remote code execution during core upgrades (CVE-2026-119977)
NVD has published CVE-2026-119977 (CVSS 8.1) for WordPress Core. Full-package core upgrades use predictable, web-accessible staging paths.
Checked in Shield: no
Who is affected
WordPress Core versions 4.7 through 7.1.3. An unauthenticated attacker could execute code on the server during the upgrade window.
How to check
In the WordPress admin, open Dashboard → Updates or check the admin footer to see the current version. If it falls within 4.7–7.1.3, the site matches the description.
How to fix
The source does not name a fixed version. Watch official WordPress releases and apply the update as soon as one is published.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Source: NVD. Fixed versions and any exploitation status are not disclosed yet.
