WordPress vulnerability is under attack, and WordPress 7.1.4 fixes it
CISA added a WordPress vulnerability, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog on Tuesday, November 3, based on evidence that attackers are using it. The flaw lets someone with no login run code on a site's server while WordPress installs a core update, and it affects every version from 4.7 through 7.1.3.
What the flaw does
When WordPress installs a full-package core upgrade, it stages the new files in predictable locations that can be reached from the web. According to the CVE record, an unauthenticated attacker can use those paths to execute code on the server during the upgrade window. CISA classes it as a time-of-check time-of-use race condition.
Wordfence, which assigned the CVE, rates the flaw 8.1 out of 10 on the CVSS 3.1 scale, which counts as high severity. Its score also rates the attack complexity as high. Umut Bayram reported the issue to WordPress.
CISA's alert doesn't describe the attacks or say who is behind them. Under its directive for US federal civilian agencies, those agencies have until Friday, November 6, to fix the flaw. CISA also flagged it for forensic triage, which means agencies must check whether attackers got into a system before it was patched.
The fixed versions
WordPress fixed the flaw in version 7.1.4, released Wednesday, October 28. It's a security release with fixes for 22 vulnerabilities, many of them stored cross-site scripting issues, plus updated root certificates after the eMudhra revocation. WordPress recommends updating sites immediately.
The fixes were also backported to every older branch that still gets security updates, back to WordPress 4.7. The patched releases include:
- WordPress 7.0.8 and 6.9.11
- WordPress 6.8.12, 6.7.11 and 6.6.11
- WordPress 6.5.14, 6.4.14 and 6.3.14
- WordPress 4.7.39 for the oldest branch that still gets security fixes
Every branch in between, from 4.8 to 6.2, has its own patched release too, listed in the WordPress 7.1.4 release notes. WordPress 4.6 and earlier no longer get security updates. WordPress also stresses that only the newest version is actively supported, so the backports are a courtesy rather than a reason to stay on an old branch.
What it means for you
This flaw lives on web servers, not on the PCs and phones people use to visit sites. Anyone who runs a WordPress site needs to act, from bloggers and small businesses to the agencies and hosts that manage sites for them.
Log in to your site's dashboard and open the Updates screen to see which version you're on. If it shows anything older than 7.1.4 or the patched release for your branch, click Update Now. Sites that support automatic background updates should already have started updating on their own, but check the version instead of assuming it updated.
If a managed host runs your site, ask whether it has installed WordPress 7.1.4 or the patched release for your branch. Because CISA flagged the flaw for forensic triage, site owners who updated late may also want to check for files and admin accounts they don't recognize.
The next major version, WordPress 7.2, is planned for Tuesday, December 8.