CISA has added a WordPress Core vulnerability, tracked as CVE-2026-119977, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation.
CISA’s KEV listing gives U.S. federal civilian agencies until Nov. 6, 2026, to apply the required fix, according to CISA-linked reporting from The Hacker News.
The flaw targets the update window
WordPress described the issue in the 7.1.4 release notes as “a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window,” credited to Umut Bayram.
GitHub’s WordPress advisory says affected versions extracted complete update packages into a predictable directory inside the web-served upgrade folder. An unauthenticated attacker who wins the race against that extraction could reach remote code execution.
A narrow window can still be a serious risk
This is not the same as a vulnerability that is continuously open on every page load. Successful exploitation depends on timing: the attacker has to catch the site while a complete Core update is being unpacked.
That limiting condition does not make the issue safe to ignore. Wordfence describes the exposure as a high-severity flaw affecting WordPress Core 4.7 through 7.1.3 and says unauthenticated attackers could execute code during the upgrade window. The company has also reported attack attempts targeting the vulnerability.
The practical concern is that automated polling can turn a seconds-long condition into a real attack opportunity. A site that is already on a fixed release is protected for future updates, but the version number alone may not show whether the update process was targeted while the patch was being installed.
Fixed versions are available
WordPress released 7.1.4 on Oct. 28, 2026, and recommended immediate updating because the release contained multiple security fixes. The WordPress release notes also said security fixes were backported as a courtesy to branches eligible to receive security fixes, currently through 4.7, while only the most recent WordPress version is actively supported.
The Canadian Centre for Cyber Security said on Nov. 3 that WordPress Core prior to 7.1.4 is affected and encouraged administrators to review vendor guidance and apply updates.
Wordfence and the GitHub advisory list fixed releases from 7.1.4 back through 4.7.39. Administrators running older WordPress branches should confirm the exact fixed release for that branch rather than assuming a major-version number is enough.
Checks that should happen now
For managed WordPress sites, the first question is whether the host has already applied WordPress 7.1.4 or the fixed release for the relevant older branch. For self-managed sites, administrators should verify the Core version in the dashboard, through WP-CLI, or from the site files.
Confirm WordPress Core is running 7.1.4 or a patched older-branch release.
Review access logs from Oct. 28 onward for suspicious requests to PHP files under wp-content/upgrade, especially repeated polling patterns around update times.
Look for unfamiliar administrator accounts, new or modified plugins, and unexpected PHP files after the update.
Preserve relevant logs before rotating or deleting them if suspicious activity appears.
These checks do not replace incident response if there is evidence of compromise. They are fast triage steps that can help decide whether a deeper review is needed. Broader maintenance checks, including backups, access control, plugin hygiene, and log review, are covered in Tech Help Canada’s website security checklist.
The safest reading is not to delay updates. It is to treat exploited core vulnerabilities as operational incidents rather than routine maintenance reminders.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
