CVE-2026-119977

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 7.1.4 WordPress versions prior to 7.0.8 WordPress versions prior to 6.9.11 WordPress versions prior to 4.7.39

Description A remote code execution issue exists during the core upgrade process. When a full upgrade occurs, a complete copy of the software is extracted into the wp-content/upgrade/wordpress-/ directory. Because the directory name is predictable and the directory is cleared before extraction, a brief window of time is created where the wp-admin/setup-config.php endpoint is accessible to external users. An attacker can use this window to complete an installation against a remote MySQL database, log into the temporary administrator account, and upload a malicious plugin containing PHP to achieve code execution. Alternatively, an attacker can write a wp-config.php file that may later be copied to the site root during subsequent unpatched upgrades or reinstalls, allowing the attacker to control the site via their own database. Exploitation requires a full-package upgrade, a web-accessible wp-content/upgrade/ directory capable of executing PHP, and the ability for the target to reach the attacker's MySQL server.

Recommendations Update to version 7.1.4, 7.0.8, 6.9.11, or 4.7.39. As a temporary mitigation, block access and PHP execution for the wp-content/upgrade/ directory at the web server layer.