If you run a WordPress site, this is a good week to check your version number. A flaw in the way WordPress updates itself, tracked as CVE-2026-119977, was added to the US CISA list of known exploited vulnerabilities on November 3, 2026. The fix is already available, and applying it takes a few minutes.

This guide explains what happened in plain language and gives you a short list of steps to follow.

What happened

WordPress released version 7.1.4 on October 28, 2026. It is a security release, and it includes a fix for a race condition in the core update process. The issue is rated 8.1 (high) and affects WordPress versions 4.7 through 7.1.3.

Here is the idea behind it. When WordPress runs a full core update, it unpacks the new files into a staging folder inside wp-content/upgrade/. In affected versions that folder name was predictable and could be reached from the web. During the short time the update was running, a visitor with no account could try to use those staged files and run code on the server.

Wordfence reported more than 18,500 requests aimed at these staged installer paths in the first 21 hours after the details became public. Those are attempts, and security teams have not described them as confirmed break-ins. Still, CISA listing it means real-world use has been seen, so it is worth treating as a priority.

Which versions are fixed

WordPress backported the fix to older branches. These are the patched versions Wordfence lists:

  • 7.1 branch: 7.1.4
  • 7.0 branch: 7.0.8
  • 6.9 branch: 6.9.11
  • Older branches down to 4.7 also received patches

If you are on an old branch, the better long-term move is to upgrade to the current release, since only the latest version is actively supported.

What to do: update WordPress core

What to do: Open Dashboard, then Updates, and install the offered version. Confirm the number shows 7.1.4 or the fixed release for your branch. If you use WP-CLI, run wp core version to check and wp core update to update.

Do not assume an automatic update finished. Look at the version number yourself.

What to do: block the upgrade folder

What to do: Ask your host, or set a rule on your web server, to deny web access to PHP files inside wp-content/upgrade/. That folder is only meant for WordPress to use during updates, so visitors never need to reach it. If you use a firewall plugin such as Wordfence, check that its protection is switched on. Sites on the free Wordfence plan receive new rules later than paid plans, so the server rule is a useful extra layer there.

What to do: look through your logs

What to do: Search your access logs for requests to setup-config.php under wp-content/upgrade/. If you find none, that is good news. If you find some, check that your wp-config.php file and your list of administrator users look the way you expect, and change your passwords as a precaution.

What to do: update plugins at the same time

Core was not the only thing in the news. Patchstack reported attacks on the Bricksforge plugin (CVE-2026-85097), which was fixed in version 3.1.8.10. Elementor Pro versions up to 4.2.1 had a file upload issue (CVE-2026-32475) that was fixed in 4.2.2. If you use either one, check that you are on the fixed version.

The wider habit is simple: update plugins and themes at least once a week, and remove any you no longer use.

A pattern worth noticing

Attackers now begin scanning within hours of a patch going public. WordPress 7.1.4 came out on October 28, and probing began the same week. That means a long gap between a release and your update is the riskiest period. Turning on automatic updates for core security releases, together with regular backups, shortens that gap a lot.

Quick checklist

  1. Check your version and update to 7.1.4 or the fixed release for your branch.
  2. Block PHP access to wp-content/upgrade/.
  3. Search logs for setup-config.php requests in that folder.
  4. Update Bricksforge and Elementor Pro if you use them.
  5. Make sure a recent backup exists.
  6. Remove plugins you do not use.

Closing thought

This one is easy to deal with: a single update closes the door. If you would like a hand checking several sites, setting up safe automatic updates or reviewing your logs, the team at Expert Web Developer is happy to help. More guides are on Grow Smart with AI.

Also published on expertwebdeveloper.in, growsmartwithai.com, Medium, Substack and LinkedIn.

Sources