WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

Summary

WordPress Core, the content management system's core software, is affected by this vulnerability. An unauthenticated attacker could potentially execute code on the affected server during a core upgrade, which could lead to full control of the site.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Oct 31, 2026, 5:33 AM UTCCVE published
2. Oct 31, 2026, 5:42 AM UTCFirst seen by cve.now
3. Oct 31, 2026, 5:54 AM UTCPosted on X by cve.now

Affected versions

• WordPress Foundation WordPress

  From 4.7.0 · through 4.7.38; From 4.8.0 · through 4.8.33; From 4.9.0 · through 4.9.34; From 5.0.0 · through 5.0.30; From 5.1.0 · through 5.1.27; From 5.2.0 · through 5.2.29; From 5.3.0 · through 5.3.26; From 5.4.0 · through 5.4.24; From 5.5.0 · through 5.5.23; From 5.6.0 · through 5.6.22; From 5.7.0 · through 5.7.20; From 5.8.0 · through 5.8.18; From 5.9.0 · through 5.9.19; From 6.0.0 · through 6.0.17; From 6.1.0 · through 6.1.15; From 6.2.0 · through 6.2.14; From 6.3.0 · through 6.3.13; From 6.4.0 · through 6.4.13; From 6.5.0 · through 6.5.13; From 6.6.0 · through 6.6.10; From 6.7.0 · through 6.7.10; From 6.8.0 · through 6.8.11; From 6.9.0 · through 6.9.10; From 7.0.0 · through 7.0.7; From 7.1.0 · through 7.1.3

References 8