Urgent awareness alert. This is awareness content, not a monitored threat intelligence service: always check vendor advisories against your own environment.
On 3 November 2026 CISA added a WordPress core flaw, CVE-2026-119977, to its Known Exploited Vulnerabilities catalogue, based on evidence of active exploitation. It is a race condition in the way WordPress applies core updates: while a site is updating, the new files are briefly unpacked in a predictable, web-accessible staging folder, and an unauthenticated attacker who reaches them in that window can run code on the server. It affects WordPress 4.7 to 7.1.3. Wordfence rates it CVSS 8.1, although WordPress itself rates it low. WordPress fixed it in version 7.1.4 on 28 October, with fixes for older supported branches such as 7.0.8, 6.9.11, and 6.8.12. Any organisation running a self-hosted WordPress site that is not yet on a fixed release should treat this as urgent.
What to do:
- Update every WordPress site to 7.1.4, or the fixed release for its branch, and check that automatic background updates are working. Move sites on 4.6 or earlier, which no longer get security fixes, to a supported version.
- Check for compromise: look for unexpected PHP files in the wp-content/upgrade/ folder and elsewhere, new administrator accounts, and unfamiliar plugins or scheduled tasks.
- Restrict exposure: block public web access to the wp-content/upgrade/ folder at your web server or web application firewall.
Source: WordPress 7.1.4 security release
If you would like help assessing your exposure, contact us.
