WordPress 7.1.4: the update-process flaw (CVE-2026-119977) that is already exploited
9 Νοεμβρίου 2026 · 2 min read
Updated: 9 November 2026. WordPress 7.1.4 was released on 28 October with 22 security fixes. The most serious one, CVE-2026-119977, sits in the WordPress core update process itself and is already used in attacks. On 3 November the US cybersecurity agency CISA added it to its Known Exploited Vulnerabilities (KEV) catalog.
What happened, in plain words
When WordPress updates its core, it unpacks the new files for a few seconds into a temporary folder inside the site (wp-content/upgrade/). That path is predictable and, on many servers, reachable from the web. An attacker who hits that short window can run their own code on the server.
- No account on the site is needed.
- It only works while a full core update is running, so the window is narrow — but attackers send requests automatically and at scale.
- Severity: 8.1 out of 10 (CVSS).
Wordfence logged more than 18,500 requests to these staging paths in the first 21 hours after disclosure, and 12,632 blocked attacks in a single 24-hour period.
Which versions are safe
| Branch | Vulnerable | Safe from |
|---|---|---|
| 7.1 | 7.1.0 – 7.1.3 | 7.1.4 |
| 7.0 | 7.0.0 – 7.0.7 | 7.0.8 |
| 6.9 | 6.9.0 – 6.9.10 | 6.9.11 |
| 6.8 | 6.8.0 – 6.8.11 | 6.8.12 |
| 6.7 | 6.7.0 – 6.7.10 | 6.7.11 |
| 6.6 | 6.6.0 – 6.6.10 | 6.6.11 |
| 6.5 and older | down to 4.7 | the latest release of that branch (e.g. 6.5.14, 6.4.14, 5.9.20) |
If your site has automatic security updates on (the WordPress default), it has probably updated already. Don’t assume it — check.
What to do today
- Check your version. Dashboard → Updates, or the bottom-right corner of any admin screen.
- Update if needed. Take a backup first. If the site sells or takes bookings, update at a quiet hour and test cart, forms and payments afterwards.
- Block web access to the update folder.
wp-content/upgrade/never needs to open in a browser, and a firewall plugin inside WordPress cannot stop this attack, so the rule belongs on the server:- Apache / LiteSpeed: in the site’s main
.htaccess(not insideupgrade/— WordPress empties that folder on every update) addRedirectMatch 403 ^/wp-content/upgrade/. - Nginx:
location ^~ /wp-content/upgrade/ { deny all; }
Updates keep working, because they run on the server, not through the browser.
- Apache / LiteSpeed: in the site’s main
- Look for traces. Unknown administrator accounts, unknown
.phpfiles inwp-content/upgrade/orwp-content/uploads/, and changes towp-config.phpyou didn’t make.
What else 7.1.4 fixes
The other fixes are mostly stored XSS issues that need an account on the site (Contributor or Editor), an issue that showed unpublished Customizer changes to visitors, and Interactivity API problems. Less urgent, but relevant to sites with many users or guest writers.
Want us to check?
If you’re not sure which version your site runs or how to add the server rule, send us your site address and we’ll tell you what it needs.