WordPress Core: Exploited Remote Code Execution Vulnerability

secpoint (49)in #secpoint • 3 days ago

WordPress disclosed an upgrade-process vulnerability on 28 October 2026, now tracked as CVE-2026-119977. Linux and Windows installations can be affected.

During full-package core updates, an unauthenticated attacker who wins a timing race could execute code through a web-accessible temporary installer. Exploitation requires the vulnerable upgrade window, not simply an exposed website.

Protect potentially affected systems by blocking web access to the temporary upgrade directory before updating to WordPress 7.1.4 or the applicable fixed release for your branch.

SecPoint Penetrator helps organizations identify exposed web services and prioritize remediation.

Get a FREE vulnerability scan:
https://www.secpoint.com/free-vulnerability-scan.php

Become a SecPoint partner:
https://www.secpoint.com/partner-signup.php

#SecPoint #WordPress #RemoteCodeExecution #VulnerabilityManagement #CyberSecurity

#cybersecurity #wordpress #remotecodeexecution #vulnerabilitymanagement

3 days ago in #secpoint by secpoint (49)

$0.00