The U.S. cybersecurity agency CISA added a WordPress core flaw, CVE-2026-119977, to its Known Exploited Vulnerabilities list on Nov. 3. The fix shipped Oct. 28 in WordPress 7.1.4, a security update the project says to install immediately. A listing on that catalog means attacks have been confirmed, not just theorized.

What the WordPress vulnerability allows

CISA describes a time-of-check time-of-use race condition that could let unauthenticated attackers run code on the server during the upgrade window. The cause, it says, is predictable, web-accessible staging paths used during full-package core upgrades. WordPress.org lists it as a weakness in the upgrade process that can lead to remote code execution, reported by Umut Bayram.

Wordfence rates it CVSS 8.1, High. Its entry says it blocked 14,057 attacks targeting this flaw in the past 24 hours, as of about 9:10 a.m. ET on Nov. 4. CISA does not say whether ransomware groups are using it.

Who is affected by this WordPress security update

Wordfence lists WordPress core 4.7.0 through 7.1.3 as affected. The exposure is narrow, though: the risk exists during a full-package core upgrade, not on every site at all times. Sites that already run a patched version have nothing to do.

CISA's Nov. 6 deadline applies to U.S. federal agencies, which must apply the vendor's fix by then. Everyone else has no deadline, but the same flaw is under attack.

What to do: update WordPress now

  1. Sign in and open Dashboard > Updates, then click Update Now.
  2. Check the version afterward on the same Updates screen. You want 7.1.4, or the patched release for your branch.
  3. If your site supports background auto-updates, WordPress says it will update itself. Confirm it did rather than assuming.
  4. Older branches got backports, all the way back to 4.7. Patched versions include 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14 and 6.3.14, down to 4.7.39. Update within your branch if you cannot move to 7.1.4.
  5. If your host manages WordPress for you, ask the host to confirm the patched version is installed.

The same release also fixes several stored cross-site scripting bugs, a stored denial-of-service issue and other flaws, so it is worth installing for more than this one.

Why it matters

A core flaw is different from a plugin bug. Every WordPress site runs core, so keeping plugins current does not cover it. The window is limited to upgrades, but attacks are already being blocked in volume, so update now rather than at the next maintenance slot.

If you are cleaning up after a different WordPress incident, see our UpdraftPlus breach checklist. Other recent patch stories: GitLab's critical self-managed flaw and Apple's exploited iOS bug.

What we do not know

  • Who is attacking: the sources name no attacker or victim, and we have no exploit details beyond the description above.
  • Compromise signs: none of the sources lists indicators of a hacked site.