WordPress core upgrade flaw lets attackers run code on sites while they update (CVE-2026-119977)

4 November 2026CriticalBeing exploited

WordPress · WordPress core · CVE-2026-119977

WordPress core upgrade flaw lets attackers run code on sites while they update

A weakness in the way WordPress core stages its files during a full upgrade can let an unauthenticated visitor run code on the server while the upgrade is in progress. CISA added it to its Known Exploited Vulnerabilities list on 3 November. Wordfence reported attackers probing sites within hours of the 7.1.4 release, and the Hacker News says it blocked nearly 63,000 attacks in a day; none of the sources we opened report confirmed compromises.

Affected: WordPress core 4.7 through 7.1.3, per Wordfence's analysis reported by The Hacker News.
What to do: Update to WordPress 7.1.4 (released 28 October) now; sites with automatic background updates will update themselves. WordPress says fixes for older branches, back to 4.7, are being backported and will ship as ready. After updating, look for unexpected administrator accounts, plugins or PHP files, and for odd requests to PHP files under wp-content/upgrade; treat the site as compromised if you find any.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: On CISA's KEV list; attacked within hours of the patch; affects the platform most of our clients' sites run on.

WordPress core upgrade flaw lets attackers run code on sites while they update

Affected

WordPress core 4.7 through 7.1.3, per Wordfence's analysis reported by The Hacker News.

What to do

Update to WordPress 7.1.4 (released 28 October) now; sites with automatic background updates will update themselves. WordPress says fixes for older branches, back to 4.7, are being backported and will ship as ready. After updating, look for unexpected administrator accounts, plugins or PHP files, and for odd requests to PHP files under wp-content/upgrade; treat the site as compromised if you find any.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

On CISA's KEV list; attacked within hours of the patch; affects the platform most of our clients' sites run on.