In short: CVE-2026-119977 is under active exploitation, according to the CISA Known Exploited Vulnerabilities list. Update WordPress to 7.1.4, or the latest security release of your branch. Then check that the update completed.

What happened

WordPress released version 7.1.4 in late October 2026 as a security release. Among its fixes is a weakness in the upgrade process that could allow remote code execution, meaning someone could run their own code on the web server, during the upgrade window.

CISA describes the issue as a race condition: during a full-package core upgrade, files are staged in predictable folders that can be reached from the web, and an attacker who does not sign in could use them to run code in that short window. CISA recorded it as CVE-2026-119977 and set November 6, 2026 as the date for United States federal agencies to act.

Who is affected

  • Any website running WordPress Core below the fixed release for its branch. Published reports list 7.1.4 and 7.0.8 as fixed releases.
  • WordPress says fixes are being backported as a courtesy to branches back to 4.7, and that only the most recent version is actively supported. Versions older than 4.7 are not included, so plan an upgrade.

What to do now

  1. Sign in to WordPress and open Dashboard, then Updates, to see your version.
  2. Back up the website, then update to 7.1.4. Sites with automatic background updates should update on their own, but confirm it.
  3. Ask your website host or developer to check the web server logs for unusual requests to PHP files under wp-content/upgrade/, and for files nobody recognizes.
  4. If you find anything unusual, treat it as a security incident and get help before making more changes.

Not sure what your website runs?

Our free Website Vulnerability Check shows whether your website runs a platform such as WordPress. It does not replace checking the version in your dashboard.

Check my website

Sources

Need a hand? Contact Hexafusion and we will talk through your website with you.