For: people who run WordPress sites (self-managed servers, VPS, shared hosting, managed WordPress hosting) and people who leave site updates to an agency or provider. This article is based on the WordPress project's announcement and advisory, the CVE record and press coverage. It does not cover attack steps.
Developing: this page will be updated as more is published
- Who is affected
people who run WordPress sites (self-managed servers, VPS, shared hosting, managed WordPress hosting) and people who leave site updates to an agency or provider.
- Confirmed so farSee the table ↓
- The flaw
- Affected versions
- Fixed versions
2 more
- Severity
- CVE number
- Not yet confirmed
- Whether CISA adds the CVE to the Known Exploited Vulnerabilities catalog (not listed on November 2)
- Any confirmed exploitation or compromise (the security vendor has reported none)
- NVD's own assessment (status: Received)
1 more
- When the project announces the fixed versions for older branches (the announcement says they will ship as they become ready)
- What to do nowSee the steps ↓
- Check your WordPress version
- Check that auto-updates are working
- Back up, then update manually
3 more
- Check the version and the site afterwards
- If someone else manages the site, ask them
- If you updated late, look at activity since October 28
- Where to verify (source)All sources ↓
- WordPress project, "WordPress 7.1.4 Security Release" (October 28, 2026)
- Last checked
- As of November 2, 2026 (JST)
Follow-up plans and what we checked
The WordPress announcement for security release 7.1.4 says it is recommended that you update immediately, and that sites with automatic background updates will begin updating on their own. The CVE was published on October 31. Press coverage reports requests aimed at the flaw but no successful compromise.
What to do today
Check your WordPress version
Open Dashboard > Updates in the admin screen to see your current version and whether a newer one is offered. If you cannot log in, or you look after several sites, wp core version works on the server if WP-CLI is installed. Fixed versions are 7.1.4 (7.1 branch), 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14 and 6.4.14. The advisory also lists fixes for older branches (see the table below).
Check that auto-updates are working
By default WordPress applies small updates such as security fixes on its own. They can be switched off by a setting in the configuration file, a plugin, your host's configuration or file permissions. Open Tools > Site Health in the admin screen and look for problems with background updates. If you do not know why auto-updates are off, update by hand this time.
Back up, then update manually
Back up the files and the database somewhere off the server (backup and recovery essentials). Then press Update Now on the Updates screen. Do not close the browser or start other updates while it runs.
Check the version and the site afterwards
Confirm the Updates screen shows the latest version, and that the home page, login and contact forms work. 7.1.4 also contains several stored XSS fixes, so look for warnings from your plugins and theme.
If someone else manages the site, ask them
For sites run by an agency, a partner, a shared host or a managed host, ask today who updates WordPress core and when. Check the version yourself in the admin screen as well.
If you updated late, look at activity since October 28
Look since October 28 for requests you do not recognise, files you did not put there, and administrator accounts you did not add. How to check is covered in how to check whether your website or server was compromised.
Auto-updates on
They start on their own (the announcement). Confirm on the Updates screen that it happened
Auto-updates off or failing
You update. Back up, update, test
Agency or host manages it
Ask who updates and when, and check the version yourself too
What the announcement and advisory say
The WordPress project published "WordPress 7.1.4 Security Release" on wordpress.org on October 28, 2026, with a list of fixes. The explanation of this flaw is in the GitHub security advisory published on October 29.
- Release
- WordPress 7.1.4 was released on October 28, 2026. The announcement says it is recommended that you update your sites immediately
- The flaw (advisory)
- During a core update that uses a complete package, WordPress extracted the new files to a predictable directory inside the web-served upgrade folder. An unauthenticated attacker who wins a race against that extraction could reach remote code execution (RCE)
- Wording in the announcement
- Listed as a weakness in the upgrade process that can lead to remote code execution during the upgrade window. The announcement page gives no severity, CVE number or list of affected versions
- Fix
- Fixed in 7.1.4. According to the advisory, as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. The announcement says backports will ship as they become ready
- Severity (WordPress)
- The advisory rates it Low and gives no score
- Auto-updates
- The announcement says that for sites with automatic background updates, the update process will begin automatically
- Support
- The announcement says only the most recent version of WordPress is actively supported
- Other fixes in the release
- Several stored XSS issues, and unpublished Customizer changesets that unauthenticated users could discover, among others (the announcement's list)
- CVE
- CVE-2026-119977, published by the security vendor Wordfence acting as the CNA. NVD's status is Received and NVD has not added its own assessment
- Description
- WordPress core 4.7 through 7.1.3: predictable, web-accessible staging paths used during full-package core upgrades allow unauthenticated attackers to execute code on the server during the upgrade window
- Severity (CVE)
- CVSS v3.1 8.1 (High): network, no privileges, no user interaction, attack complexity High. Weakness type CWE-367 (time-of-check time-of-use race condition)
- Disagreement
- WordPress's advisory says Low and the CVE record says High. They come from different assessors, so neither is simply wrong. This site's view is that with a fix available, updating is the right priority even for a hard-to-exploit flaw
Fixed versions (from the advisory)
| Branch | Affected | Fixed |
|---|---|---|
| 7.1 | 7.1.0 to 7.1.3 | 7.1.4 |
| 7.0 | 7.0.0 to 7.0.7 | 7.0.8 |
| 6.9 | 6.9.0 to 6.9.10 | 6.9.11 |
| 6.8 | 6.8.0 to 6.8.11 | 6.8.12 |
| 6.7 | 6.7.0 to 6.7.10 | 6.7.11 |
| 6.6 | 6.6.0 to 6.6.10 | 6.6.11 |
| 6.5 | 6.5.0 to 6.5.13 | 6.5.14 |
| 6.4 | 6.4.0 to 6.4.13 | 6.4.14 |
| 6.3 | 6.3.0 to 6.3.13 | 6.3.14 |
| 6.2 | 6.2.0 to 6.2.14 | 6.2.15 |
| 6.1 | 6.1.0 to 6.1.15 | 6.1.16 |
| 6.0 | 6.0.0 to 6.0.17 | 6.0.18 |
| 5.9 to 5.0 | up to each branch's last release | 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28, 5.0.31 |
| 4.9 to 4.7 | up to each branch's last release | 4.9.35, 4.8.34, 4.7.39 |
The advisory lists no fix for 4.6 and earlier. Old branches do not always update themselves, so if you still run one, update by hand or plan a move to a supported release.
Exploitation (from press reports)
This comes from a security vendor's report as relayed by the press. The WordPress project's announcement says nothing about exploitation.
- Who observed
- A WordPress security vendor. According to SecurityWeek (October 30), the vendor said exploitation began within hours of the patches rolling out
- Numbers
- The first match for the vendor's new firewall rule came nine minutes after it was deployed, and in the first 21 hours it logged more than 18,500 requests aimed at temporary update locations
- Successful compromise
- The vendor has not reported any
- What an attack needs (press)
- A very narrow window while WordPress is unpacking a complete core update. According to the report, attackers are repeatedly polling the vulnerable paths to catch it
- KEV
- When this site checked CISA's KEV catalog on November 2, 2026 (catalog last updated October 30), CVE-2026-119977 was not listed
This site's view: not being in KEV does not mean safe. What has been observed is a count of requests that look like probing, with no successful compromise reported, but the fix is only days old and the picture may change. Sites where auto-updates are off are the ones most likely to lag.
What is known and not known
| Item | What was published | Status |
|---|---|---|
| The flaw | A race condition during a complete-package core update that can lead to unauthenticated RCE; fixed in 7.1.4 (WordPress advisory) | Confirmed (WordPress) |
| Affected versions | 4.7 to 7.1.3 (CVE record, advisory) | Confirmed (WordPress, CVE record) |
| Fixed versions | 7.1.4 and fixes for every branch back to 4.7 (advisory) | Confirmed (WordPress) |
| Severity | WordPress: Low (no score). CVE record: CVSS v3.1 8.1 (High), attack complexity High | Confirmed (differs by assessor) |
| CVE number | CVE-2026-119977, published October 31; not in WordPress's announcement | Confirmed (CVE record) |
| Requests aimed at the flaw | More than 18,500 in the first 21 hours (security vendor, press) | Reported (security vendor) |
| Successful compromise | The vendor has reported none | None reported |
| CISA KEV | Not listed as of November 2 | Not listed |
| NVD's own assessment | Not yet added (status: Received) | Not yet scored by NVD |
Can the update wait?
According to the advisory, the problem occurs during a complete-package core update. Nothing in the official sources says more about the conditions, or whether a site that has not updated is being attacked constantly. This site does not fill that gap with guesses: a fix exists, so confirm quickly that your version is a fixed one.
If you use shared hosting or managed WordPress hosting
Some plans update WordPress core for you and some leave it to you. It depends on your plan and contract, so check your version in the admin screen and read your provider's notice.
What the provider may do (depends on your plan)
- Provide automatic updates or a one-click update tool for core
- Post a notice about its response where relevant
What you do
- Check on the Updates screen that your version is a fixed one
- Check that auto-updates have not been switched off, and update by hand if they have
- Read provider notices on its official site, not through email links
- Keep plugins and themes up to date too
Your site may be briefly unavailable during an update. Some servers fail to update because of file permissions or disk space. If that happens, make sure you can restore from backup and then contact your provider.
Watch for fake emails that pose as your provider
When a vulnerability is in the news, emails posing as hosting or domain providers ("update immediately", "your account will be suspended") become more common. Do not log in through links in email; check on the official site you bookmarked yourself. How to recognise them is covered in what phishing is.
This site's view: the problem is not the update button, it is updates that have stopped
This flaw was in the very process meant to keep a site safe. With a fix out, the risk that remains is on sites where auto-updates are off, sites where nobody owns updating, and sites left on old branches. For how to prioritise see how to prioritise vulnerabilities (CVSS, EPSS, KEV), and for what to do after disclosure see the vulnerability-response playbook.
Timeline
October 28, 2026
The WordPress project releases 7.1.4, fixing a flaw in the update process that can lead to RCE, several stored XSS issues and others.October 29
WordPress publishes the GitHub security advisory: a race condition during complete-package core updates, with the fix backported to every branch back to 4.7. The CVE field reads "No known CVE".October 30
Press reports that a WordPress security vendor saw a first firewall-rule match nine minutes after deploying the rule and logged more than 18,500 requests in the first 21 hours. No successful compromise is reported.October 31
Wordfence, as CNA, publishes CVE-2026-119977, CVSS v3.1 8.1 (High). NVD status: Received.November 2
This site checks the announcement, advisory, CVE record and KEV. The CVE is not listed in KEV.
Sources (public record)
Checked on November 2, 2026. The official announcement comes first, press coverage after.
- WordPress project, "WordPress 7.1.4 Security Release" (October 28, 2026) — wordpress.org
- WordPress GitHub security advisory GHSA-4w3m-c66w-69mg, "A race condition during core updates that could lead to remote code execution" (October 29, 2026) — github.com
- CVE-2026-119977 (published October 31, 2026 by Wordfence) — cve.org / nvd.nist.gov
- CISA Known Exploited Vulnerabilities catalog (checked on November 2 for this CVE; data last updated October 30) — cisa.gov / JSON
- Press: SecurityWeek, "Fresh WordPress Vulnerability in Attackers' Crosshairs" (October 30, 2026) — securityweek.com
Update history
2026-11-02: First version, based on the WordPress announcement and advisory, the CVE-2026-119977 record and SecurityWeek's report. The CVE was not listed in KEV on November 2.
Read next
- Was your site attacked: How to check whether your website or server was compromised
- Hardening WordPress: WordPress security
- Preparation: Backup and recovery essentials / Security inventory checklist
- Another critical fix the same month: PHP's two critical flaws and emergency fixed releases (October 2026) / Checking the PHP your site actually runs after an emergency patch
- Terms: What is RCE (remote code execution) / What is CVSS