WordPress Core RCE via Predictable Upgrade Staging Paths

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

WordPress Core versions 4.7 through 7.1.3 contain a critical remote code execution vulnerability that exploits predictable, web-accessible staging directories created during full-package upgrades. An unauthenticated attacker can leverage this weakness to execute arbitrary code on the server during the upgrade window—a narrow but exploitable timeframe when many WordPress administrators perform maintenance. This vulnerability affects millions of WordPress installations globally, making it a high-impact threat regardless of authentication requirements. The CVSS score of 8.1 reflects the combination of easy exploitation, wide attack surface, and severe impact on system integrity.

Casky's 224 mapped security skills enable practitioners to identify the attack patterns underlying this CVE through MITRE ATT&CK technique TA0004 (Privilege Escalation). When monitoring WordPress environments, practitioners using Casky's Claude-powered extended reasoning will detect indicators such as: suspicious HTTP requests to predictable upgrade paths (e.g., /wp-content/upgrade/), unusual file creation during upgrade processes, and unexpected code execution from staging directories. The platform's skill mapping helps security teams recognize that this vulnerability chains staging path enumeration with code execution, allowing them to set up detection rules for POST/PUT requests to upgrade directories, monitor for temporary files with executable permissions, and correlate these findings with WordPress version checks. This enables proactive defense during critical upgrade windows when organizations are most vulnerable.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-119977.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-119977

Casky has 224 skills that investigate the attack patterns behind CVE-2026-119977. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn