WordPress Core Vulnerability Exploited: Update Now

You may have updated WordPress last week and moved on. Now there is a reason to look again. As of 4 November 2026, the US cyber agency CISA lists a WordPress core vulnerability exploited in the wild, and the fix is the same 7.1.4 release you may have already seen.

This post covers only what is new. For the full list of fixes, the certificate change and generic update steps, read our earlier post on the WordPress 7.1.4 security update.

WordPress core vulnerability exploited: what changed

WordPress released 7.1.4 as a security release on 28 October 2026, according to WordPress.org. Our earlier post noted that neither the announcement nor the HelpHub page listed CVE IDs or reported exploitation.

On 3 November 2026, CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalog. The entry is for WordPress Core and classifies it as a race between checking a file and using it (TOCTOU). Its weakness class is CWE-367.

A KEV listing means CISA has evidence of exploitation in the wild. That is all we can say. As of 4 November 2026, none of the sources we read give the scale, the attackers or any indicators. We are not claiming mass exploitation, and you should be wary of anyone who does without a source.

What CISA says the flaw does

CISA says an attacker with no login could get code running on the server while an upgrade is in progress. The route is predictable, web-accessible staging paths used in full-package core upgrades.

In plain terms, WordPress prepares files in a temporary place while it updates itself. For a short time, that place can be guessed and reached from the web. A race condition means an attacker only has to act inside that short window.

CISA's entry cites the WordPress 7.1.4 announcement, so it ties the CVE to that release. The WordPress.org pages do not name the CVE. They do list "a race condition during core updates that could lead to remote code execution", credited to Umut Bayram, on the HelpHub page for 7.1.4. The two descriptions fit together, but WordPress.org has not confirmed the CVE or the exploitation. We are relying on CISA for those.

Does CISA's 6 November date apply to you?

CISA's entry shows a due date of 6 November 2026. As we read how KEV works, this is the deadline for US federal agencies. It is not a legal deadline for a small business site.

Treat it as a prompt, not a rule. If your site is not on a fixed version yet, update today rather than on the 6th.

How to confirm you are on a fixed version

Fixed versions are 7.1.4, or the backport for your branch. HelpHub lists backports such as 7.0.8, 6.9.11 and 6.8.12, all the way down to 4.7.39. As of 4 November 2026 it says each of these has been released. Anything older than 4.7 is unsupported and receives no security fixes.

Only the latest version is actively supported, and older fixes are a courtesy. If you are on an old branch, plan the move to 7.1.4.

Check your version in one of these ways. The first WP-CLI command shows the installed version, and the second shows whether a newer core release is available:

1. In the dashboard, open Dashboard > Updates. It shows the installed version and any pending update.
2. With WP-CLI on the server, run the commands below.

wp core version
wp core check-update

If an update is pending, take a backup first, then update from the dashboard or with wp core update. Our earlier post has the full steps.

Check that auto-updates really ran

Many sites update themselves, and that is where people assume too much. Do not assume it worked. Look at the version number, as above, and confirm it matches a fixed release.

If the version is still old, find out why. Common causes are auto-updates switched off, file permissions that stop WordPress writing to its own folders, or a host that manages core updates for you. Ask your host if you are not sure.

A hardening check for the upgrade folder

This step is general hardening. No source we read names the exact folder involved, so do not treat it as a confirmed check for this CVE.

The idea is simple: temporary update files should not be reachable from the internet. WordPress commonly keeps its working files in a folder such as wp-content/upgrade. Open your site's address with that path in a private browser window, or test it from a terminal, replacing example.com with your domain. Look at the status code, because you do not want a readable directory listing:

curl -sI https://example.com/wp-content/upgrade/

A 403 or 404 is a reasonable result. A directory listing, or files you can open, is worth raising with your host or developer. Blocking direct web access to such folders is cheap and does no harm.

If you were updating in the window

We cannot tell you a site was safe, and nobody can prove a site was never touched. If your site ran a full-package core update during the period of concern, a short review is sensible:

• Verify core files. Run wp core verify-checksums. It compares your core files with the official ones and flags changes.
• Look for unknown files. Check for recently changed or unfamiliar PHP files, especially in wp-content.
• Review users. Look for administrator accounts you do not recognise.
• Read the logs. Check web server logs around your update times for odd requests.
• Rotate secrets if anything looks wrong. Change admin passwords, database credentials and the keys in wp-config.php.

CISA's required action for federal bodies is to apply vendor mitigations, follow BOD 26-04 and its forensic triage requirements, and stop using the product if mitigations are not available. A private site does not have to follow that process, but the order is a good guide: patch, then investigate.

What to do next

1. Confirm your version today. Aim for 7.1.4, or your branch's backport if you cannot move yet.
2. Check that auto-updates actually applied the fix.
3. Run the upgrade-folder check as general hardening.
4. Verify core files with wp core verify-checksums and scan for unknown files and users.
5. Re-check CISA's catalog and WordPress.org later this week. Details like these tend to change.

If you manage several sites, or you are not sure whether yours was affected, contact Paraline Tech. We can review your version, update setup and hosting for you.