A WordPress Flaw Is Being Exploited During Updates. Check You Are on 7.1.4 Today.

On 28 October WordPress released version 7.1.4, a security release fixing a dozen issues. The most serious was a weakness in the upgrade process that "could lead to remote code execution during the upgrade window". WordPress said: "it is recommended that you update your sites immediately."

Six days later, on 3 November, the US Cybersecurity and Infrastructure Security Agency (CISA) added that flaw, CVE-2026-119977, to its catalog of Known Exploited Vulnerabilities. That catalog only lists flaws with evidence of real attacks. CISA gave US federal agencies until 6 November, three days, to fix it.

What the flaw does, in plain terms

When WordPress updates itself, it unpacks the new version into temporary folders before moving it into place. CISA's description says those staging paths are predictable and reachable from the web, so an attacker who times a request to the short window during a full upgrade can get their own code run on the server. No login is needed.

The uncomfortable part is that the risky moment is the update itself. A site that updates is briefly exposed; a site that has already updated to 7.1.4 is not. That is why being on the fixed version matters more than how often the site updates.

This is the fourth WordPress core flaw added to CISA's exploited list in 2026, after two in July and one in September. Attacks on WordPress used to be mostly about plugins. This year the core software has been a target too.

Who should worry

• Any WordPress site below 7.1.4 that has not received a patched release for its branch. WordPress says fixes are being backported to older branches "through 4.7", and that "the backports are in progress and will ship as they become ready".
• Sites where automatic updates are switched off, often because a developer turned them off years ago to stop a theme breaking.
• Sites nobody logs into. A brochure site built three years ago and left alone is exactly the kind of site that is still on an old version today.

Seven checks for this week

1. Confirm the version, do not assume it. Log in and open Dashboard → Updates. It should say 7.1.4 or later. If you have several sites, check every one; auto-update being "on" is a setting, not a result.
2. Take a backup, then update. If the site is not on 7.1.4, back up files and database first, then update. Most hosts offer one-click backups in the control panel.
3. If you are on an old branch, plan the move. Only the latest version is actively supported. If a theme or plugin is the reason the site cannot update, that dependency is now a security problem, not a design one.
4. Look for admin users you do not recognise. Users → All Users, filtered by Administrator. An extra admin account is the most common sign that someone got in.
5. Look at recently changed files and plugins. A plugin you did not install, or files in wp-content modified on a day nobody worked on the site, needs a closer look. Your host's malware scanner can do this for you.
6. Run an outside check. Our free website hacked checker compares what visitors and Googlebot see, and looks for hidden redirects, spam words and strange sitemaps. It cannot see inside the server, so a clean result is a start, not proof.
7. Write down who is responsible. For most small businesses the honest answer to "who updates our website?" is "nobody in particular". Name a person or a provider, and how they will tell you it is done.

The wider pattern

Last month researchers documented AI agents attacking more than 1,200 websites, mostly small online shops, for about $50 per successful break-in. Automated tools make it cheap to try a fresh flaw against every site on the internet within days of it being published. The gap between a fix being released and a fix being installed is where small sites get hurt.

The 7.1.4 release also credits Anthropic, the AI company, with reporting two of the issues it fixed. AI is now finding flaws in widely used software as well as exploiting them, which means more fixes, released more often. The routine that copes with that is the boring one: updates checked, backups taken, and someone responsible for both.

Sources

• WordPress.org, WordPress 7.1.4 Security Release, 28 October 2026. The upgrade-window remote code execution issue, the full list of fixes and credits (including two reported by Anthropic), "update your sites immediately", backports through 4.7 in progress, 7.2 planned for 8 December.
• CISA, Known Exploited Vulnerabilities Catalog, entry for CVE-2026-119977, added 3 November 2026, due 6 November 2026. The time-of-check time-of-use description, unauthenticated code execution during the upgrade window, predictable web-accessible staging paths. WordPress core entries added in 2026 counted from CISA's catalog feed on 8 November 2026.