Wednesday, 4 November 2026Global tech news & guides — what changed, and what it means for you.
AuTechWire
Illustration of a server mid-update with files moving between racks while a shadowy hand reaches into the transfer

WordPress CVE-2026-119977: Attackers Exploit the Update Window

by

CISA added a WordPress core bug to its Known Exploited Vulnerabilities catalogue on November 3 and gave US federal agencies just three days to deal with it. The flaw, CVE-2026-119977, is unusual: it can only be used while a site is upgrading WordPress itself. So the moment you apply a core update is the moment an attacker can get in.

The fix shipped in WordPress 7.1.4 on October 28, and the patch for every older branch is now out as well. If your site updated itself in the last week, it is probably patched. But CISA has also flagged this entry for forensic triage, which means patching is only half the job. You also need to check whether anyone got in during an earlier update.

What the bug actually does

The Wordfence Intelligence record describes it as an unauthenticated remote code execution flaw in WordPress 4.7 through 7.1.3. It is caused by “predictable, web-accessible staging paths used during full-package core upgrades.”

Here is what that means in practice. When WordPress installs a full core package, it first unpacks the files into a working folder inside the site, then copies them into place. If an attacker can guess where that folder is and reach it over the web while the update runs, they can get code executed on the server. They need no login and no click from anyone. The flaw is a classic time-of-check to time-of-use race (CWE-367).

The timing requirement explains the CVSS 3.1 score of 8.1 rather than something higher. The vector is AV:N/AC:H/PR:N/UI:N: anyone on the network can try it and it needs no privileges, but attack complexity is rated high because the attacker has to hit a short window. CISA’s own triage data, attached to the NVD entry on November 4, rates it “exploitation: active”, “automatable: no” and “technical impact: total”.

The researcher credited is Umut Bayram of Picus Security. Despite the high complexity rating, attackers are trying it at scale. When we checked the Wordfence record on November 4, it said Wordfence had blocked 13,665 attacks aimed at this vulnerability in the previous 24 hours.

Timeline

Date (2026) Event
Oct 28 WordPress 7.1.4 released as a security release with 13 fixes. Wordfence publishes its record the same day.
Oct 29 Wordfence lists the other 7.1.4 fixes, mostly stored XSS in blocks and the Interactivity API.
Oct 31 CVE-2026-119977 published to NVD, sourced from Wordfence.
Nov 3 CISA adds it to the KEV catalogue with forensic triage required.
Nov 6 CISA remediation deadline for US federal civilian agencies.

Three days is at the short end of CISA’s range. Of the catalogue’s other additions since October 20, most also got three days, including Ivanti, GitLab, Cisco and PHP bugs, while VMware, Adobe Commerce, Brotli and a second Ivanti flaw got 14.

Affected and fixed versions, branch by branch

The 7.1.4 release post said fixes were being backported to every branch back to 4.7 and would ship “as they become ready”. We checked WordPress.org’s public version API on November 4: all 25 patched builds are now live. Only 7.1.4 is marked “latest”. Every other patched build is marked “outdated”, because only the current release gets full support.

Branch Vulnerable up to Patched in
7.1 7.1.3 7.1.4
7.0 7.0.7 7.0.8
6.9 6.9.10 6.9.11
6.8 6.8.11 6.8.12
6.7 6.7.10 6.7.11
6.6 6.6.10 6.6.11
6.5 6.5.13 6.5.14
6.4 6.4.13 6.4.14
6.3 6.3.13 6.3.14
6.2 6.2.14 6.2.15
6.1 6.1.15 6.1.16
6.0 6.0.17 6.0.18
5.0 – 5.9 5.0.30 … 5.9.19 5.0.31 … 5.9.20
4.7 – 4.9 4.7.38 … 4.9.34 4.7.39 … 4.9.35

Version ranges are from the NVD record and Wordfence’s remediation list. Release status is from api.wordpress.org on November 4, 2026.

The awkward part: the fix opens the window

Here is our reading of the advisory. The vendor has not spelled this out. The weakness sits in the upgrade routine, and a site on 7.1.3 runs its own 7.1.3 upgrader to fetch and unpack 7.1.4. That means the update that fixes the bug is itself one of the risky windows. Minor background updates are switched on by default, so most sites went through that window automatically, at a time nobody chose, some time after October 28.

That is why the forensic triage flag matters more than usual. A site can be fully patched today and still have been compromised during the update that patched it.

What to do now

  • Confirm the version. Check Dashboard → Updates, or run wp core version with WP-CLI. Anything below the “Patched in” column above needs updating. Remember that many sites hide the version number in their page source.
  • Update deliberately, not blindly. If you still need to update, do it at a quiet time, with a fresh backup, and with your web application firewall rules current. Wordfence’s blocking numbers suggest firewall vendors already have signatures for this.
  • Look at the upgrade folder. After updating, check wp-content/upgrade/. It should be empty or close to it. Any PHP file left there, or any folder you can’t account for, is worth investigating.
  • Check what changed around your update time. Find when the core update ran (your host’s logs or any activity log plugin will show it). Then look for new administrator accounts, PHP files modified in wp-content/ or the site root at that time, and new scheduled tasks you didn’t create.
  • Read your access logs. Search for outside requests to paths under /wp-content/upgrade/, especially POSTs or requests that hit a .php file there. Legitimate visitors have no reason to ask for those URLs.
  • Harden for next time. One common precaution is to block direct web access to wp-content/upgrade/ at the web server or WAF. WordPress writes to it from the server side, not over HTTP. This is our suggestion, not vendor guidance, so test it on staging first.
  • Fleets and agencies. If you manage many sites, don’t just trust the dashboard’s green ticks. Audit each site’s actual version, and do the log check on any site that updated before you had firewall coverage.

The KEV deadline only binds US federal civilian agencies. But KEV listings are widely used as a “this is real” signal by security teams in the UK, Canada, Australia and elsewhere, and WordPress runs a large share of small business and media sites in all of them.

The rest of 7.1.4

The upgrade-window flaw got the CISA listing, but 7.1.4 also fixed a long list of stored cross-site scripting issues. They are in block markup, the Interactivity API, Customizer selective refresh, user logins and privacy data-removal requests, and Anthropic is credited with reporting two of them. The release also fixed a way for unauthenticated visitors to find unpublished Customizer changesets.

The release also updated WordPress’s bundled root certificates “due to the eMudhra revocation”. That ties back to the eMudhra root removal we covered last month. If your site makes outbound HTTPS calls to services still using eMudhra-issued certificates, 7.1.4 may be when those calls started failing.

It has been a heavy few weeks for anyone looking after PHP stacks. The PHP2Shell flaws hit the language runtime underneath WordPress. Stolen UpdraftCentral keys were used to backdoor WordPress sites even after the plugin was updated. And GitLab admins had to patch twice for CVE-2026-110264. The lesson is the same each time: a patch closes the hole going forward, but it says nothing about whether someone already came through it.

Sources

AuTechWire Desk

The AuTechWire Desk reports, fact-checks and edits AuTechWire coverage of AI and cybersecurity.

Related Stories