CyberSandberg Search

Cyber

ALERT from CISA

CISA says attackers are using a WordPress update flaw. Check your version and turn on automatic updates.

Video: Alert: Run a WordPress Site? Update Now (47 sec). It loads from YouTube only when you press play. Watch on YouTube

Checked

WordPress rates it Low and it is hard to pull off, but CISA has evidence of attacks. Update to 7.1.4 or your branch's fix, then turn on automatic updates.

Who is affected

People who run their own WordPress site, including class sites, family blogs and small business sites, on WordPress 4.7 through 7.1.3 that hasn't installed the patched version for its branch (WordPress security advisory). If you only visit WordPress sites, there's nothing you need to do. The flaw is on the server that runs the site (NVD).

What happened

On November 3, 2026, CISA added CVE-2026-119977, a WordPress Core flaw, to its Known Exploited Vulnerabilities list "based on evidence of active exploitation" (CISA). WordPress says that during a core update that uses a complete package, it unpacked the new files into a predictable folder that the website serves, and "an unauthenticated attacker who wins a race against that extraction could reach remote code execution," meaning they could run their own code on the server (WordPress security advisory). The attacker doesn't need a login, but it only works during the update itself and the attacker has to time it just right.

Why the ratings differ: WordPress rates the issue Low and doesn't say why (WordPress security advisory). Wordfence, which assigned the CVE number, scores it 8.1, High, and rates it hard to pull off ("high" attack complexity). NVD hasn't added its own score yet. If it works, the attacker can run their own code on the server (NVD). CISA lists it because it has evidence of active exploitation. CISA's notice doesn't describe specific attacks or name affected sites (CISA).

WordPress fixed it in 7.1.4, released October 28, 2026, and backported the fix to older branches back to 4.7 (WordPress 7.1.4, WordPress security advisory).

What to do now

  1. Update to WordPress 7.1.4. If your site is on an older branch, update to its patched version: 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18, 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28, 5.0.31, 4.9.35, 4.8.34 or 4.7.39 (WordPress security advisory). In your dashboard, click "Updates," then "Update Now" (WordPress 7.1.4). WordPress says only the most recent version is actively supported (WordPress 7.1.4).
  2. Our tip: turn on automatic core updates. WordPress says sites that support automatic background updates start the update on their own (WordPress 7.1.4).
  3. Our tip: if a host manages your site (for example, managed WordPress hosting or a school or district web team), ask them to confirm it's on 7.1.4 or the patched version for its branch.

Dates

Sources

  1. CISA, "CISA Adds One Known Exploited Vulnerability to Catalog," Nov 3, 2026 (checked Nov 3, 2026)
  2. WordPress.org, "WordPress 7.1.4," Oct 28, 2026 (checked Nov 3, 2026)
  3. WordPress security advisory GHSA-4w3m-c66w-69mg, "A race condition during core updates that could lead to remote code execution," Oct 29, 2026 (checked Nov 3, 2026)
  4. CISA Known Exploited Vulnerabilities Catalog, CVE-2026-119977 entry (added Nov 3, 2026, due Nov 6, 2026) (checked Nov 3, 2026)
  5. NVD, CVE-2026-119977 (checked Nov 3, 2026)