https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-03T09:23:10.887807+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-119977 CVE-2026-119977 — WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution 2026-11-03T09:23:10.889015+00:00

Affected: WordPress Foundation WordPress

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.