If you run a WordPress site, there is one thing worth doing today: check which version you are on. On November 3, 2026, the US cybersecurity agency CISA added a WordPress core flaw, CVE-2026-119977, to its list of vulnerabilities that attackers are already using. WordPress released the fix on October 28 in version 7.1.4, so the good news is that a patch exists. This post explains what the WordPress core vulnerability is, who it affects and what to do about it, in plain language.

In this article

What happened

WordPress 7.1.4 is a security release published on October 28, 2026. Among other fixes, it closes a weakness in the upgrade process that could let a remote attacker run code on the server during an update. The release notes also cover several stored cross-site scripting issues, a denial-of-service problem in the Interactivity API and a few smaller items, and they recommend updating immediately.

A few days later, CISA added the upgrade weakness (CVE-2026-119977) to its Known Exploited Vulnerabilities catalog. That listing means there is evidence of real-world use. It carries a CVSS score of 8.1, which is rated high. CISA set a November 6 deadline for US federal agencies, and while that date does not apply to the rest of us, it shows how seriously the issue is being taken.

How the flaw works

When WordPress applies a full core update, it unpacks the new files into a temporary folder inside wp-content/upgrade. Reports describe the problem as a timing issue: for a short moment during the update, a predictable temporary location can be reachable from the web. An attacker who reaches it at the right moment may be able to push the site toward running their code.

Two details are worth knowing. First, no login is needed. Second, the window is narrow and only opens while an update is running, so simply having an outdated site is not the same as being hacked. Security firms have reported large numbers of blocked attempts, but those numbers measure probing, not confirmed break-ins, and no widespread compromise has been publicly confirmed at the time of writing.

Who is affected

Public records list WordPress core from 4.7 up to and including 7.1.3 as affected. In practice that covers almost every site that has not yet moved to the patched release. Sites that update themselves automatically may already be safe, but it is worth confirming rather than assuming.

One point where sources differ is the exact version numbers for older branches. WordPress says the fixes are being backported to older branches that still receive security support, and that these ship as each one is ready. Because of that, the safest advice is simple: update to the newest version your site can take, and check the Updates screen for anything still pending.

What to do today

  1. Check your version. Log in to the dashboard and open Dashboard, then Updates. If you use the command line, wp core version shows it in one line.
  2. Update WordPress core. Move to 7.1.4 or the newest release available for your branch. Take a backup first so you can roll back if a plugin misbehaves.
  3. Confirm it finished. Automatic updates sometimes stall. Reload the Updates page and make sure it says you are on the latest version.
  4. Ask your host if you are on managed hosting. Ask in writing whether your site runs the patched version and whether access to the wp-content/upgrade folder is blocked from the web. Do not assume they have updated it for you.
  5. Restrict the upgrade folder if you can. Some security write-ups suggest denying web access to wp-content/upgrade while updates run. This comes from secondary reports rather than the official release notes, so ask your developer or host to apply it properly.

After you update

A quick health check takes about ten minutes and gives peace of mind, especially if your site updated itself between October 28 and now.

  • Look through the Users screen for administrator accounts you do not recognise.
  • Check the Plugins screen for anything you did not install.
  • Ask your host for access logs and look for odd requests to PHP files inside wp-content/upgrade.
  • Run a file integrity check, for example wp core verify-checksums, to see whether core files were changed.

If something looks wrong, change your admin passwords, restore from a clean backup and get help with a proper cleanup. Our earlier guide on cleaning a WordPress backdoor properly walks through the steps.

Quick checklist

  • Backup taken
  • WordPress core on 7.1.4 or the newest release for your branch
  • Updates page shows nothing pending
  • Host confirms the patch and the upgrade-folder protection
  • No unknown admin users, plugins or PHP files
  • Automatic security updates switched on

Keeping a site patched is a routine habit, not a one-off panic, and a little regular attention goes a long way. If you would rather have someone handle updates, backups and security checks for you, the maintenance team at expertwebdeveloper.in looks after exactly this kind of work, and you can also browse more guides here on Grow Smart with AI.

Sources