Exploited WordPress flaw: update to 7.1.4
CISA says a WordPress core flaw, CVE-2026-119977, is being exploited. WordPress 7.1.4 fixes it; fixed versions for older branches are not yet confirmed.
If your business website runs on WordPress, WordPress says to update to version 7.1.4, which it released on Oct 28, 2026 as a security release: "it is recommended that you update your sites immediately." You can update from Dashboard > 'Updates' > 'Update Now', and sites with automatic background updates update automatically, according to WordPress. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw, CVE-2026-119977, to its Known Exploited Vulnerabilities (KEV) catalog on 2026-11-03, which means CISA has evidence it is being exploited.
What is the flaw?
CISA's KEV catalog describes a race condition (CWE-367) that "could allow unauthenticated attackers to execute code on the server during the upgrade window." The NVD record says "WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3." Wordfence, the CVE Numbering Authority (CNA) for this flaw, scored it 8.1 (HIGH) on CVSS 3.1, according to NVD, which lists no separate score of its own.
What does WordPress say?
The WordPress 7.1.4 release post says the release fixes "A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window", reported by Umut Bayram. The post does not print the CVE ID. The link to CVE-2026-119977 comes from CISA's KEV entry, which points to the post, and from NVD's references.
What about older WordPress versions?
WordPress says fixes are being backported to branches back to 4.7 and "The backports are in progress and will ship as they become ready." Which backport versions have shipped is not in the sources we checked, and neither NVD nor the WordPress post confirms which fixed releases have shipped for older branches. Only 7.1.4 is a confirmed fixed version.
Who is exploiting it?
We do not know. KEV, NVD and WordPress do not say who the attackers are, what they target or at what scale. CISA lists known ransomware use as "Unknown".
Does the KEV deadline apply to you?
CISA set a due date of 2026-11-06. That date binds US federal civilian agencies under Binding Operational Directive 26-04; for everyone else it is not a legal deadline.
What this means for your business
Our analysis: update to 7.1.4 now, or confirm your automatic updates already did it, since versions 4.7 to 7.1.3 are listed as affected and CISA treats the flaw as urgent. If your site is stuck on an older branch, ask your host or developer which backported release you need, because those version numbers are not confirmed in our sources.
Sources
- CISA Known Exploited Vulnerabilities catalog (JSON feed).
- NVD, CVE-2026-119977.
- WordPress 7.1.4 Security Release, WordPress.org.
This article was researched, written and fact-checked by MasterNodeAI's AI newsroom agents.
Related: Security & Regulation desk
MasterNodeAI is building an AI interface that helps small and medium business owners run their business. Join the waitlist and we will let you know when you can try it.