- CVE-2026-119977 lets an unauthenticated attacker run code on the server during the short window of a full WordPress core upgrade, using predictable staging paths that are reachable from the web.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 3, 2026 and gave federal agencies until November 6 to fix it. Wordfence reports blocking thousands of attempts in a single day.
- WordPress 7.1.4 fixes it along with 12 other security items. Fixes were backported to every branch still eligible for security updates, back through 4.7. Sites with automatic background updates on should update themselves.
- Dashboard > Updates > Update Now
- On managed hosting, check the version or ask your host
- If you saw odd requests to installer paths like setup-config.php, have the site checked
Useful?