# WordPress upgrade flaw now exploited, fixed in 7.1.4 > CISA says attackers are using a WordPress core bug that opens during updates. A third of WordPress sites run an older branch that needs its own fix. - Published: 2026-11-04 - Author: 28creation Desk - Format: News - URL: https://28creation.com/articles/wordpress-upgrade-flaw-exploited-7-1-4/ ## The short read **CISA has marked its fourth WordPress core flaw of 2026 as exploited; the patch shipped October 28.** - The bug lets an attacker with no account run code during a full core update. Fixes exist for every branch back to 4.7. ### What you can do with this > Open Dashboard, then Updates, and confirm the site runs 7.1.4 or the patched release for its branch, such as 7.0.8 or 6.9.11. That closes the hole attackers are already probing. --- The US Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress core flaw, CVE-2026-119977, to its [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) on November 3, which means it has evidence of attacks. The fix is [WordPress 7.1.4](https://wordpress.org/news/2026/10/wordpress-7-1-4), released October 28. If your company site runs WordPress, check its version today. [The Hacker News reported the exploitation](https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html) on November 4. Our own count from the KEV catalog: it is the fourth WordPress core entry this year, after two on July 21 and one on September 25. Every earlier entry listed under WordPress in the catalog is a plugin. ## The bug opens a short window during updates [WordPress's security advisory](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg) explains the cause. During a core update that uses a complete package, WordPress "extracted the new files to a predictable directory" inside the web-served upgrade folder. An attacker without an account who "wins a race against that extraction could reach remote code execution." So the risk is not constant. It exists for the brief window while a full update runs, so attackers have to keep asking for the right path to catch one. That is what the traffic shows. The Hacker News, citing Wordfence, reports more than 18,500 requests aimed at staged "setup-config.php" installer paths in the first 21 hours after disclosure, and 12,632 blocked attempts in 24 hours at the time of writing. Previdian's honeypot sensors logged three attempts on October 30. ## A third of WordPress sites run an older branch The fix was backported to every branch back to 4.7. The advisory lists the patched releases, including 7.0.8, 6.9.11, 6.8.12 and 4.7.39. That matters because many sites are not on the newest branch. [WordPress.org's version statistics](https://api.wordpress.org/stats/wordpress/1.0/), which we read on November 4 at 14:39 UTC, put 65.2% of sites on the 7.1 branch and 33.9% on branches from 4.7 to 7.0. The statistics count branches, not minor releases, so they cannot show how many sites already have the fix. A further 0.95% run versions older than 4.7, which the advisory does not list as affected or patched. ## What WordPress and CISA disagree on WordPress rates the issue "Low" in its advisory. The Hacker News gives it a CVSS score of 8.1, high. The low rating fits a bug that needs perfect timing. The CISA listing says that timing is being attempted at scale anyway. CISA gives US federal agencies until November 6 to fix it and marks it for forensic triage, meaning agencies should also check for signs of compromise. That deadline binds only federal agencies, but it is a fair clock for anyone else. Whether ransomware groups use the bug is "Unknown," the catalog says. ## What to do now - **Check the version.** In the admin, open Dashboard, then Updates. The [release post](https://wordpress.org/news/2026/10/wordpress-7-1-4) says sites with automatic background updates get 7.1.4 on their own, and others can click "Update Now." - **On an older branch, confirm the minor release.** WordPress.org's [update service](https://api.wordpress.org/core/version-check/1.7/) offers 7.0.8, 6.9.11 and 6.8.12 as automatic updates on those branches. Anything below the patched number in the advisory is exposed. - **Ask your host if it manages updates.** Get the exact version in writing rather than "we keep it current." - **Look at your logs.** Search for requests to setup-config.php inside the upgrade folder, the path pattern Wordfence saw attackers try. A hit is an attempt, not proof of a break-in, but a hit during an update window deserves a closer look at new PHP files. The same release fixes a dozen other issues, most of them stored cross-site scripting bugs, so an update you skipped in October is now overdue for more than one reason. ## Sources - CISA, Known Exploited Vulnerabilities catalog (JSON, version 2026.11.03): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - WordPress, "WordPress 7.1.4 Security Release," October 28, 2026: https://wordpress.org/news/2026/10/wordpress-7-1-4 - WordPress, security advisory GHSA-4w3m-c66w-69mg, October 29, 2026: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg - The Hacker News, "CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades," November 4, 2026: https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html - WordPress.org version statistics API, read November 4, 2026: https://api.wordpress.org/stats/wordpress/1.0/ - WordPress.org core version-check API, read November 4, 2026: https://api.wordpress.org/core/version-check/1.7/