WordPress CVE-2026-119977: Update to 7.1.4 Now

Short answer: CVE-2026-119977 is a flaw in WordPress core itself, not a plugin. CISA says it is being exploited. It can let an attacker with no account run code on your server while a full WordPress update is in progress. Update to WordPress 7.1.4 (released October 28, 2026), then check your site for signs of a break-in.

The key facts

A race condition means two actions overlap and an attacker slips in between them. Per CISA's wording quoted by The Hacker News, the cause is "predictable, web-accessible staging paths used during full-package core upgrades". In plain terms, WordPress unpacks files into locations that outsiders can guess and reach, and for a short time those files can be abused.

Neither major report states which older versions are affected, so do not assume you are safe on an older release. Check the Wordfence advisory for your version, or simply update.

Step 1: update WordPress core to 7.1.4

1. Take a backup first (files and database). See why site backups matter.
2. Open Dashboard, Updates and install WordPress 7.1.4.
3. Confirm the version shown on the same Updates screen afterwards.

If you manage many sites, update the publicly reachable ones first. This is a security release, and the WordPress team says to update immediately.

Step 2: check for signs of an attack

Security firm Wordfence reported more than 18,500 requests in the first 21 hours after disclosure aimed at staged setup-config.php installer paths. Look in your web root for:

• a setup-config.php file or folder you do not recognise, outside the normal wp-admin location
• new administrator accounts you did not create (Users, All Users)
• recently changed files you did not edit (ask your host, or use a file integrity scanner)
• unexpected PHP files in wp-content/uploads

If you find any of these, treat the site as compromised: restore a clean backup, update, and change all passwords and keys.

Step 3: reduce your exposure

• Run updates when traffic is low and watch the site during the process, since the risk is tied to the upgrade window.
• Use a web application firewall that has a rule for this CVE. Wordfence reported blocking over 13,000 attacks in 24 hours.
• Remove unused admin accounts and use strong admin passwords.
• Keep plugins and themes current as well. See outdated CMS plugins.

Common mistakes

• Thinking "I only use trusted plugins" means core is not a concern. This flaw is in core.
• Updating but never checking for leftover files or new admin users.
• Updating without a backup, then having no way back if something breaks.
• Waiting for auto-updates without checking they actually ran. Confirm your version number.
• Assuming a small site is not a target. These attacks are automated.