WordPress upgrade flaw now exploited: what to check
CISA says attackers are targeting a WordPress core flaw fixed in version 7.1.4. Here is what it means for a business website and what to check this week.
If your business website runs on WordPress, check its version today. On November 3, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress core flaw, CVE-2026-119977, to its list of vulnerabilities being exploited in real attacks. The fix has been out since October 28, in WordPress 7.1.4, so for most sites this is a quick job. The risk is the site nobody has logged in to for months.
What the flaw is
According to BleepingComputer, the bug is a race condition in the way WordPress upgrades itself. During a full core upgrade, WordPress unpacks files into staging folders whose location can be predicted and reached from the web. An attacker who times requests to that short window could run code on the server without logging in. The attack is rated as hard to pull off, but it does not need a password. The flaw was reported by Umut Bayram of Picus Security.
When WordPress released 7.1.4, its security team described the issue as a weakness in the upgrade process and recommended updating sites immediately. Severity ratings differ. Webhosting.Today notes that WordPress's own advisory labels it low, while the Wordfence record scores it 8.1 out of 10, which is high.
Why CISA's listing matters
CISA's alert says the flaw was added based on evidence of active exploitation. Federal agencies had until November 6 to deal with it. That deadline doesn't bind a private business, but the listing tells you attackers are already trying it. Wordfence told BleepingComputer it blocked 13,095 attempts in a single day. Webhosting.Today points out that this was probing, and that Wordfence did not describe a successful break-in. It is also the fourth WordPress core flaw CISA has listed since July.
What your business should do
- Check the version. Log in to the WordPress dashboard and look under Dashboard, then Updates. You want 7.1.4, or the security release for your branch if your host keeps you on an older one. Webhosting.Today reports backports reach as far back as the 4.7 branch.
- Find out who is responsible. Many small firms had a site built years ago by a designer who has moved on. If you're not sure who updates it, ask your web host whether automatic core updates are on and whether they apply backports.
- Back up before you update. Take a copy of the files and database, and make sure it's stored somewhere other than the web server.
- Ask about the upgrade folder. Patchstack suggests blocking web access to the wp-content/upgrade/ folder at the web server. That is a job for your host or developer, not something to try from the dashboard.
- Look for signs of trouble. Unfamiliar admin accounts, plugins you didn't install, new files in odd places or pages that redirect visitors elsewhere all deserve a closer look. Updating closes the hole but doesn't remove anything an attacker left behind.
The bigger point
Your website is part of your IT, even if it lives with a separate company. It holds contact forms, sometimes customer logins, and your reputation. Put it on the same update routine as your office computers and firewall. Our patch management service covers that kind of routine, and our small business security checklist is a good place to see what else is overdue.
Not sure what your site runs or who looks after it? Call (213) 986-4855 or see our cybersecurity page.