As of November 2026, there is a confirmed, actively exploited remote code execution vulnerability in WordPress core, and if your site is running anything older than version 7.1.4, it is currently at risk. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 2, 2026. This is not a theoretical risk. Attacks are happening right now.
What this vulnerability actually does
The flaw is a time-of-check time-of-use (TOCTOU) race condition buried in the way WordPress handles full-package core upgrades. During the brief window while WordPress is updating itself, it uses predictable, web-accessible staging paths to store installer files. An unauthenticated attacker, meaning someone with no account on your site at all, can target those paths and execute arbitrary code on your server if they hit that window at the right moment.
The practical difficulty is real: the attack window only lasts as long as the update itself, which is usually a matter of seconds. Wordfence rates it 8.1 (High) on the CVSS scale, and according to Wordfence’s analysis published November 5, 2026, attackers started probing for it on the same day it was disclosed, October 28. By their count, the Wordfence Firewall has already blocked over 240,000 exploit attempts. The Hacker News also reported, citing telemetry from Previdian, that honeypot sensors recorded exploitation attempts as early as October 30.
Successful exploitation means complete site compromise: files modified, backdoors planted, data exposed. The race condition makes it hard to pull off, but 240,000 attempts tells you that people are trying at scale and not giving up.
Who is affected by CVE-2026-119977
The vulnerability affects WordPress core versions 4.7 through 7.1.3. That is a wide range covering roughly a decade of releases. The WordPress Security Team released patches on October 28, 2026, both in the new 7.1.4 release and as backported fixes for every supported older branch. If your host or update process has not applied one of these patched versions, your site is exposed every time it runs a core update.
One point worth flagging: updating from a vulnerable version to the patched version will run the vulnerable upgrade process one last time. Wordfence is explicit that this is still the right move. The window is short, the risk during that single update is lower than leaving the site unpatched indefinitely, and once you are on a patched version, future upgrades are no longer affected. If you want an extra precaution before updating, block web access to PHP files in the /wp-content/upgrade/ directory at the server level first.
Federal agencies had until November 6, 2026 (today) to apply fixes under CISA’s binding directive for FCEB agencies. If the U.S. government treats this as a drop-everything priority, so should you.
How to check your site and what to do next
Log into your WordPress dashboard and look at the bottom of any admin screen. It shows your current version. If it reads anything other than 7.1.4 (or one of the backported patched versions listed by Wordfence), you need to update before anything else today.
If you are on managed hosting, open a support ticket right now and ask two things: what WordPress version is currently running on your site, and has the host applied the CVE-2026-119977 patch. Good managed hosts will have done this already for customers with automatic updates enabled. If yours has not, escalate.
If you manage your own server and have automatic background updates turned on in WordPress, you are likely already on a patched version, but verify. Do not assume.
- Check your WordPress version in the admin dashboard footer or under Dashboard > Updates.
- If you are below 7.1.4, run the core update immediately, or ask your host to do it.
- Before updating, optionally block PHP execution in
/wp-content/upgrade/at the web server level for extra caution. - After updating, confirm the version number changed to 7.1.4 or the correct patched branch release.
- If you use Wordfence Free, note that the firewall rule covering this exploit does not roll out until November 27, 2026, so updating the core is your primary protection right now.
This is exactly what a care plan is for
Situations like this are the reason we built our care and maintenance plans the way we did. When a critical vulnerability drops, we do not wait for clients to notice it in the news. Core updates, security monitoring, and patching are part of the routine, not an emergency upsell. We watch for disclosures, apply updates during low-traffic windows, and verify that the site comes back clean afterward.
If your current setup leaves you reading a security alert and wondering whether your site is patched, that gap is worth closing. Whether you need a care plan, a one-time security review, or just want to understand what is running on your site, book a free 30-minute call and we will tell you exactly where things stand. No pressure, no jargon.
