Small Town Sysadmin
Free CJIS checklist

Tech basics

Security alert

Update WordPress to 7.1.4 or your branch's latest release: a flaw in the update process is being exploited

CISA added a WordPress core flaw to its exploited list on November 3. Sites that update normally are protected once on a fixed release, and auto-updates should deliver it.

If your office website runs on WordPress, check that it has updated since October 28. A flaw in WordPress’s own update process (CVE-2026-119977) lets an attacker who isn’t logged in run code on the web server, but only during the short window while WordPress is upgrading itself. The Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on November 3, 2026, with a due date of November 6 for federal agencies.

This is a different flaw from the one in September’s WordPress alert. Being patched for that one doesn’t cover this one.

Who is affected

According to the National Vulnerability Database (NVD), every WordPress release from 4.7 through 7.1.3 is affected. The National Vulnerability Database’s score for the flaw, assigned by Wordfence as the CVE numbering authority, is 8.1 (High); the “high complexity” part of the score reflects that the attacker has to catch the upgrade window.

What to do

Update to a fixed release. WordPress shipped 7.1.4 on October 28 and backported the fix to older branches. As of November 4, WordPress’s update service offers these as the latest release on each branch:

If you’re on Update to at least
7.1 7.1.4
7.0 7.0.8
6.9 6.9.11
6.8 6.8.12
6.7 6.7.11
6.6 6.6.11
6.5 6.5.14
6.4 6.4.14
Older branches (4.7 through 6.3) The latest release for your branch; WordPress lists one for every branch back to 4.7

How to check: log in to the WordPress dashboard and open Dashboard > Updates. It shows your version and any update waiting. If you see “Update Now,” click it. WordPress says sites with automatic background updates receive 7.1.4 on their own, but automatic updates can be switched off by a host or a plugin, so confirm the version rather than assuming.

If someone else runs your website (a web designer, a hosting company, or your IT provider), ask them to confirm in writing which WordPress version the site is on today.

CISA’s entry for this flaw says it requires forensic triage. If your site was running an affected version while it upgraded itself between October 28 and now, ask your host or IT provider to look for files and admin accounts you don’t recognize. If you can’t get an answer, restore from a backup taken before the upgrade and update from there.

While you’re at it

The same 7.1.4 release fixes 12 other problems, most of them cross-site scripting flaws, so updating is worth doing for that alone.

  • Update plugins and themes too. Outdated plugins remain a common way sites get taken over.
  • Turn on two-step sign-in for WordPress administrator accounts. See turn on two-step sign-in.
  • Check that the site is backed up before the next update, so you can restore if something goes wrong.
  • Remember that WordPress itself may not be the only layer to patch: see PHP2Shell for the server-side PHP flaws from late October.

Sources

All articles