On 3 November 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed real-world attacks on a WordPress flaw that opens while a site updates its core. It is the bug fixed in WordPress 7.1.4 on 28 October. Any WordPress site running a version from 4.7 to 7.1.3 is exposed.
What we know
- The flaw: according to WordPress's GitHub advisory (29 October), during a core update with the full package, WordPress unpacked the new files into a predictable, web-reachable folder. An attacker with no account who hits that short window could run code on the server.
- What CISA says: on 3 November it added the flaw, as CVE-2026-119977, to its Known Exploited Vulnerabilities catalog, «based on evidence of active exploitation». US federal agencies must fix it by 6 November and run a forensic check.
- What Wordfence says: the WordPress security company published it on 28 October, scores it 8.1 out of 10 (High) and, on its entry as read on 4 November, says it blocked 14,312 attacks against this flaw in the past 24 hours. It credits Umut Bayram of Picus Security.
- Why the ratings differ: WordPress's advisory rates it Low, because an attacker has to catch the exact moment of an update. Wordfence and CISA treat it as serious because success means control of the server.
- Fixed versions: 7.1.4, plus 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18 and so on down to 4.7.39 for older branches, per the same advisory.
What changes and what doesn't
- The urgency changes. This is no longer one item on the 7.1.4 list: attacks are confirmed by a government agency and counted by a security vendor.
- The fix doesn't. There is no new patch. The 7.1.4 release (or your branch's release) from 28 October is the fix. WordPress lists no workaround.
- What is unclear: none of the sources says whether the update from a vulnerable version to the fixed one opened that window itself. So sites updated after 28 October are worth checking too, not only those still behind.
- Very old sites: versions 4.6 and earlier get no patch at all; a site still there has a bigger problem than this flaw.
How to tell if you're affected
- Check your version. In the WordPress dashboard, go to Dashboard → Updates. It should show 7.1.4 or your branch's fixed version (list above). If not, the site is vulnerable.
- If it's behind, update today. Take a full backup first (files and database), or ask your host for one. If automatic updates are turned off, this is the reason to review that choice.
- Look for signs of a break-in, especially if the site was updated manually or late since 28 October: check Users for administrators you don't recognise, and run a security scanner that compares core files with the official ones.
- On shared or managed hosting, ask in writing: «Which WordPress version is my site on? When was it updated? Can you check for new or changed PHP files on the server since 28 October?».
- If something looks wrong, don't just delete it: change the admin, hosting panel, FTP or SFTP and database passwords, and get help cleaning the site before you trust it again.
Related: WordPress 7.1.4 Security Release: What to Do Today
Sources
- CISA, «CISA Adds One Known Exploited Vulnerability to Catalog», 3 November 2026
- CISA, Known Exploited Vulnerabilities catalog, CVE-2026-119977 entry
- WordPress, advisory GHSA-4w3m-c66w-69mg on GitHub, 29 October 2026
- Wordfence, vulnerability database entry
- The Hacker News, 4 November 2026
Updates: if WordPress publishes an extra mitigation or explains how to check an affected site, it will be added here with a link.