WordPress upgrade flaw now exploited, fixed in 7.1.4
CISA says attackers are using a WordPress core bug that opens during updates. A third of WordPress sites run an older branch that needs its own fix.
The short read
CISA has marked its fourth WordPress core flaw of 2026 as exploited; the patch shipped October 28.
- The bug lets an attacker with no account run code during a full core update. Fixes exist for every branch back to 4.7.
What you can do with this
Open Dashboard, then Updates, and confirm the site runs 7.1.4 or the patched release for its branch, such as 7.0.8 or 6.9.11. That closes the hole attackers are already probing.
The US Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress core flaw, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog on November 3, which means it has evidence of attacks. The fix is WordPress 7.1.4, released October 28. If your company site runs WordPress, check its version today.
The Hacker News reported the exploitation on November 4. Our own count from the KEV catalog: it is the fourth WordPress core entry this year, after two on July 21 and one on September 25. Every earlier entry listed under WordPress in the catalog is a plugin.
The bug opens a short window during updates
WordPress’s security advisory explains the cause. During a core update that uses a complete package, WordPress “extracted the new files to a predictable directory” inside the web-served upgrade folder. An attacker without an account who “wins a race against that extraction could reach remote code execution.”
So the risk is not constant. It exists for the brief window while a full update runs, so attackers have to keep asking for the right path to catch one.
That is what the traffic shows. The Hacker News, citing Wordfence, reports more than 18,500 requests aimed at staged “setup-config.php” installer paths in the first 21 hours after disclosure, and 12,632 blocked attempts in 24 hours at the time of writing. Previdian’s honeypot sensors logged three attempts on October 30.
A third of WordPress sites run an older branch
The fix was backported to every branch back to 4.7. The advisory lists the patched releases, including 7.0.8, 6.9.11, 6.8.12 and 4.7.39.
That matters because many sites are not on the newest branch. WordPress.org’s version statistics, which we read on November 4 at 14:39 UTC, put 65.2% of sites on the 7.1 branch and 33.9% on branches from 4.7 to 7.0. The statistics count branches, not minor releases, so they cannot show how many sites already have the fix. A further 0.95% run versions older than 4.7, which the advisory does not list as affected or patched.
What WordPress and CISA disagree on
WordPress rates the issue “Low” in its advisory. The Hacker News gives it a CVSS score of 8.1, high. The low rating fits a bug that needs perfect timing. The CISA listing says that timing is being attempted at scale anyway.
CISA gives US federal agencies until November 6 to fix it and marks it for forensic triage, meaning agencies should also check for signs of compromise. That deadline binds only federal agencies, but it is a fair clock for anyone else. Whether ransomware groups use the bug is “Unknown,” the catalog says.
What to do now
- Check the version. In the admin, open Dashboard, then Updates. The release post says sites with automatic background updates get 7.1.4 on their own, and others can click “Update Now.”
- On an older branch, confirm the minor release. WordPress.org’s update service offers 7.0.8, 6.9.11 and 6.8.12 as automatic updates on those branches. Anything below the patched number in the advisory is exposed.
- Ask your host if it manages updates. Get the exact version in writing rather than “we keep it current.”
- Look at your logs. Search for requests to setup-config.php inside the upgrade folder, the path pattern Wordfence saw attackers try. A hit is an attempt, not proof of a break-in, but a hit during an update window deserves a closer look at new PHP files.
The same release fixes a dozen other issues, most of them stored cross-site scripting bugs, so an update you skipped in October is now overdue for more than one reason.
Sources
- CISA, Known Exploited Vulnerabilities catalog (JSON, version 2026.11.03): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- WordPress, “WordPress 7.1.4 Security Release,” October 28, 2026: https://wordpress.org/news/2026/10/wordpress-7-1-4
- WordPress, security advisory GHSA-4w3m-c66w-69mg, October 29, 2026: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg
- The Hacker News, “CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades,” November 4, 2026: https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html
- WordPress.org version statistics API, read November 4, 2026: https://api.wordpress.org/stats/wordpress/1.0/
- WordPress.org core version-check API, read November 4, 2026: https://api.wordpress.org/core/version-check/1.7/
