We would like to provide guidance on how to address a new vulnerability in WordPress core files—CVSS 8.1, CVE-2026-119977.

What is CVE-2026-119977?

CVE-2026-119977 was discovered on October 28, 2026, and the WordPress core team released an emergency patch for it the very next day.

This is a fairly significant vulnerability with a CVSS score (severity rating) of 8.1 out of 10.

https://nvd.nist.gov/vuln/detail/cve-2026-119977

The following WordPress versions are affected by this vulnerability.

7.1.0 – 7.1.3
7.0.0 – 7.0.7
6.9.0 – 6.9.10
6.8.0 – 6.8.11
6.7.0 – 6.7.10
6.6.0 – 6.6.10
6.5.0 – 6.5.13
6.4.0 – 6.4.13
6.3.0 – 6.3.13
6.2.0 – 6.2.14
6.1.0 – 6.1.15
6.0.0 – 6.0.17
5.9.0 – 5.9.19
5.8.0 – 5.8.18
5.7.0 – 5.7.20
5.6.0 – 5.6.22
5.5.0 – 5.5.23
5.4.0 – 5.4.24
5.3.0 – 5.3.26
5.2.0 – 5.2.29
5.1.0 – 5.1.27
5.0.0 – 5.0.30
4.9.0 – 4.9.34
4.8.0 – 4.8.33
4.7.0 – 4.7.38

This vulnerability is an unauthenticated remote code execution vulnerability present in the WordPress Core (versions 4.7 through 7.1.3) upgrade process.This vulnerability occurs in a set of files temporarily generated during a WordPress update. Exploitation requires targeting the narrow window of a few seconds while the update is in progress; sites not currently being updated are not affected. This factor reduces the severity of the vulnerability.
However, attacks are active; it is reported that over 60,000 attacks were observed within 24 hours following the https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html on the 28th.

How to Address the Vulnerability

If you are using a version of WordPress that is vulnerable, you can patch the vulnerability by applying the security update. (In most cases, updates are applied automatically.)

You can check whether your site is affected by this vulnerability by using the [Free] WordPress: Malware Scan & Security Plugin [Malware & Virus Detection and Removal].

If automatic updates are not enabled, you can either update WordPress manually through the admin panel or upload the patched version from the official WordPress website using FTP software.

*Please note that the higher the version number of WordPress, the greater the likelihood of issues. We recommend proceeding with caution—back up your site and test the update on a staging site before applying it to your live environment

.

Terms of Use for Generated AI

This page prohibits the use, quotation, or summarization of any page, in whole or in part, by the Generated AI. However, if the following conditions are met, the specification of content using generated AI is permitted.
1. it is not for the purpose of learning by the generated AI. 2. only the summary or title of the page content at a level that does not lead to the solution of the user’s problem is shown to the user. 3. in the case of 2, a link to this content is shown to lead the user to this page.

Related Posts:

  1. Serious Vulnerability in WordPress Jetpack Plugin
    A serious vulnerability has been discovered in the Jetpack plugin for WordPress and a version update has been distributed. This section explains how to deal with this vulnerability. Terms of Use for Generated AI This page prohibits the use, quotation, or summarization of any page, in whole or in part, by the Generated AI. However, if the following conditions are...
  2. Vulnerability in WordPress WP File Manager plugin
    Since the WP File Manager plugin is installed on a large number of malware-infected sites, hacking that targets vulnerabilities in this plugin may be a current trend. Terms of Use for Generated AI This page prohibits the use, quotation, or summarization of any page, in whole or in part, by the Generated AI. However, if the following conditions are met,...
  3. 7 WordPress security-critical operational policies that production companies won’t tell you about, and that you must follow after delivery.
    We will explain 7 important WordPress security operation policies that the production company won’t tell you about, and that you must follow after delivery. Terms of Use for Generated AI This page prohibits the use, quotation, or summarization of any page, in whole or in part, by the Generated AI. However, if the following conditions are met, the specification of...
  4. What is a 0Day attack that exploits a WordPress vulnerability?
    About 60% of WordPress tampering damage is caused by vulnerabilities in the old WordPress itself and plugins. Some of these are 0-day attacks. This is explained here. Terms of Use for Generated AI This page prohibits the use, quotation, or summarization of any page, in whole or in part, by the Generated AI. However, if the following conditions are met,...
  5. An example of a redirect hack embedded in a WordPress core file
    Recently there has been an increase in the embedding of JAVASCRIPT-type malware starting with trackmyposs in WordPress core files. Terms of Use for Generated AI This page prohibits the use, quotation, or summarization of any page, in whole or in part, by the Generated AI. However, if the following conditions are met, the specification of content using generated AI is...
  6. Vulnerability in File Manager Plugin, which allows WordPress to operate like FTP software
    The File Manager plug-in, which enables file manipulation on the administration screen like FTP software and has been installed on over 700,000 sites, has a very dangerous vulnerability in version 6.9 or lower. Terms of Use for Generated AI This page prohibits the use, quotation, or summarization of any page, in whole or in part, by the Generated AI. However,...