In short: WordPress core 4.7 through 7.1.3 has a flaw that lets an unauthenticated attacker run code on the server while the site is being updated. On 3 November 2026 CISA added it to its catalog of actively exploited vulnerabilities. Update to 7.1.4 (or the fixed release of your branch) and make sure the version number actually changed.
What happened
WordPress 7.1.4 was released on 28 October 2026 with 22 security fixes. The most serious one is CVE-2026-119977.
During a full core update, WordPress briefly unpacks files into a directory whose path is predictable and reachable from the web. If an attacker requests such a file during that short window, their code runs on the server. No login is needed. It is a time-of-check/time-of-use race condition (CWE-367).
- Severity: CVSS 8.1, High (Wordfence score in NVD).
- Actively exploited: added to the CISA KEV catalog on 3 November 2026.
- The attack works during an update, so the sites most at risk are those still on an old version that are about to update.
Affected versions
All versions from 4.7 to 7.1.3 inclusive.
Fixed versions:
| Branch | Safe version |
|---|---|
| 7.1 | 7.1.4 (recommended) |
| 7.0 | 7.0.8 |
| 6.9 | 6.9.11 |
| 6.8 | 6.8.12 |
| 6.7 | 6.7.11 |
| 6.6 … 4.7 | the patch release of your branch, e.g. 6.4.14, 5.9.20, 4.7.39 |
WordPress 4.6 and older will not be fixed. Update such sites to a current version or take them offline.
What site owners should do
- Check the version. In the admin area, open Dashboard → Updates. Do not rely on auto-updates alone: a plugin or config can switch them off, and file permissions can break them.
- Back up files and the database before updating.
- Update WordPress to 7.1.4 or the fixed release of your branch, then check the version again.
- Update plugins and themes. 7.1.4 also fixes several XSS issues in blocks and the Interactivity API.
- Does a developer run your site? Send them this article and ask them to confirm the version.
For VPS and dedicated server owners
Extra protection while you update every site: block web access to the update staging directory wp-content/upgrade/. WordPress uses it through PHP; browsers never need it.
nginx:
location ^~ /wp-content/upgrade/ { deny all; }
Apache or LiteSpeed (.htaccess in the site root):
RewriteEngine On
RewriteRule ^wp-content/upgrade/ - [F,L]
This does not replace the update; it only narrows the attack window. Also check wp-content/upgrade/ for unexpected .php files. If you find any, treat the site as compromised: change admin passwords and the keys in wp-config.php, and scan the site for malicious code.
How we help our clients
If your site is hosted with us and you are not sure which WordPress version you run or how to update safely, contact support. We will check and help. 24/7 monitoring and emergency support; in business hours we usually reply within 15 minutes.
Hosting where engineers watch security
Weekly backups in every plan, CloudLinux isolation, DDoS protection and WAF. We migrate your site for free.
Choose a plan →
Sources
Also read: Critical PHP Security Release, October 21, 2026.
Questions? Contact support.