Skip to contentistheinternetok
All incidents

Security flaw·Critical

WordPress sites: a flaw during updates lets attackers run code

Fix availableAttackers already use itAffects website owners
WordPress Core

What it changes for you

Nothing visible for you; site owners must update.

A flaw in how WordPress updates itself can let an attacker with no account take over a site while an update is running. WordPress released a fix, and CISA says attackers already use the flaw.

Started Oct 28, 2026Updated Nov 4, 2026

Post on X

What should I do?

You
Nothing to do.
If you run a website or an app
Update WordPress to 7.1.4 (or the matching fixed release of your branch) now, and block web access to wp-content/upgrade/. Check that your site was not compromised.

What is affected

CVE-2026-119977

Timeline

  1. Fix available · Nov 3, 2026

    CISA adds CVE-2026-119977 to its Known Exploited Vulnerabilities catalogue: attackers use the flaw. Wordfence had reported thousands of probing requests since the patch.

    CISA

  2. Fix available · Oct 28, 2026

    WordPress 7.1.4 fixes a weakness in the core upgrade process that can allow remote code execution during the upgrade window. Fixes for older branches back to 4.7 are rolling out.

    WordPress

Sources