2026-11-02
WordPress 7.1.4 flaw CVE-2026-119977: a core-update race that can lead to remote code execution is fixed; check your version and auto-updates
On October 28, 2026, the WordPress project released security release 7.1.4, which fixes a flaw in the core update process that can lead to remote code execution. According to WordPress's GitHub advisory, during a core update that uses a complete package, WordPress extracted the new files to a predictable directory inside the web-served upgrade folder, and an unauthenticated attacker who wins a race against that extraction could reach remote code execution (RCE). The fix ships in 7.1.4 and is backported to every branch back to 4.7 (7.0.8, 6.9.11, 6.8.12 and so on). CVE-2026-119977 was published on October 31 by Wordfence as the CNA, rated CVSS v3.1 8.1 (High) with attack complexity High; WordPress's advisory rates it Low and gives no score. According to SecurityWeek, a WordPress security vendor saw its first firewall-rule match nine minutes after deploying the rule and logged more than 18,500 requests aimed at temporary update locations in the first 21 hours; the vendor has reported no successful compromise. This site checked CISA's Known Exploited Vulnerabilities (KEV) catalog on November 2 and the CVE was not listed. Sites with automatic background updates should update on their own; sites with auto-updates off should update manually from the Updates screen. This site's conclusion: confirm your version, and update by hand today if auto-updates are not working.