WordPress Core CVE-2026-119977 Allows Pre-Auth Remote Code Execution

En bref

• CVE-2026-119977 affects WordPress core versions 4.7 through 7.1.3 and some older branches.
• Exploitation requires no login and can lead to full site and server takeover.
• WordPress 7.1.4 contains the fix; backports cover select older releases.
• Attackers were probing by late October 2026, with risk rising during November upgrade windows.
• K-12 and government sites should inventory versions and patch internet-facing instances first.

WordPress security maintainers have published a fix for a high-severity flaw in the core platform, assigned CVE-2026-119977. The corrective release, version 7.1.4, arrives after evidence that adversaries are already scanning for susceptible installations. Patches have also been prepared for older branches that remain in support.

The defect permits remote code execution without any authentication. An attacker who reaches a vulnerable endpoint can cause arbitrary instructions to run on the underlying host, which in practice means a full takeover of the site and potential access to other resources on the same server. No administrative login is needed, lowering the skill barrier for exploitation.

The scope includes WordPress installations ranging from version 4.7 to 7.1.3, as well as selected earlier maintenance branches. The team has backported fixes where possible, but sites on unsupported versions need a migration plan rather than a patch. Because many K-12 districts run mixed estates—some sites pinned to old versions by legacy plugins or custom themes—the exposure is uneven and easy to overlook.

The timeline is tight. Probing activity was observed around 28 October 2026, and November brings a heightened risk of exploitation while organizations schedule and stage upgrades. Attackers frequently target the gap between patch availability and completion, especially on shared hosting where one outdated site can affect neighbors.

For New Brunswick schools and government sites, inventory is the first control. Confirm which WordPress instances are public-facing, identify any below 7.1.4, and treat unsupported branches as urgent remediation candidates. Watch web logs for unusual POST requests and signs of new files or processes. Wordfence and other WAF tools can provide temporary virtual patching, but they are not a substitute for the vendor update.

À faire maintenant

1. Upgrade every WordPress core installation to 7.1.4 or later; prioritize internet-facing sites and multisite networks.
2. For branches with backports, apply the vendor-supplied patch immediately; retire versions that no longer receive fixes.
3. Enable virtual patching through Wordfence or your WAF as an interim control while upgrades are scheduled.
4. Search web and server logs for probing patterns and indicators of code execution; preserve evidence before cleanup.
5. Rotate WordPress salts, administrative credentials, and any secrets stored on affected hosts; review user accounts for unauthorized additions.
6. Isolate or rebuild any site showing compromise; check for lateral movement to databases and adjacent services.
7. Maintain an inventory of WordPress versions and plugin/theme dependencies; set a recurring patch cadence.

Références CVE

• CVE-2026-119977

Source originale

Wordfence