CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ2 of 2 advisories (Page 1/1)
2026-10-31
WordPress Core Remote Code Execution (RCE) Vulnerability Alert (CVE-2026-119977)
[Affected Scope] WordPress Core versions 4.7 through 7.1.3
[Impact] Unauthenticated attackers can execute arbitrary code on the server by exploiting predictable staging paths during the core upgrade process
[Mitigation] Immediately upgrade to WordPress 7.1.4 or later and restrict web access to the upgrade staging directories
2026-09-22
WordPress Core get_page_template() Local File Inclusion (LFI) and Remote Code Execution (RCE) (CVE-2026-87902)
[Affected Scope] All WordPress installations running vulnerable core versions and specific themes.
[Impact] Unauthenticated attackers can include and execute arbitrary local PHP files, leading to full server compromise.
[Mitigation] Immediate update to the latest WordPress security release and deployment of WAF filtering rules.