WordPress Core Update Vulnerability Actively Exploited 2026: What Every Site Owner Must Do Today

The WordPress core update vulnerability actively exploited 2026 is tracked as CVE-2026-119977. The US Cybersecurity and Infrastructure Security Agency confirmed it this week. The flaw lets attackers run code on your server without logging in. It works only during the brief window when your site performs a full WordPress core update. CISA added it to its Known Exploited Vulnerabilities catalog on November 3, and Wordfence is currently blocking over 13,000 exploitation attempts every single day.

What Is CVE-2026-119977?

CVE-2026-119977 is a Time-of-check Time-of-use (TOCTOU) race condition in WordPress Core. CVSS assigns it a severity score of 8.1 out of 10. During a full-package upgrade, WordPress temporarily places new files in a web-accessible staging directory. One of those files is an installation script called setup-config.php. An attacker who times a request to that location can reach the installer and execute code on the server. No account on your site is required. Researcher Umut Bayram of Picus Security discovered the flaw.

Which WordPress Versions Are Affected?

Security researchers confirmed WordPress 7.0.0 through 7.1.3 as vulnerable. Some researchers report the issue may extend back to WordPress 4.7.0, which would cover nearly a decade of releases. WordPress shipped the fix in version 7.1.4 on October 28, 2026. If your site has not yet updated, it is exposed during every full core update. In particular, check sites that receive automatic minor updates only. Without major version updates enabled, they may still run 7.1.3.

Is This Vulnerability Being Actively Attacked Right Now?

Yes. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026, confirming that real attacks are already happening. Wordfence publicly disclosed the vulnerability. It recorded more than 18,500 requests targeting the staged installer paths in the first 21 hours alone. By the following weekend, Wordfence was blocking over 13,000 attacks against this vulnerability every day. Wordfence first observed active exploitation on October 30, just two days after WordPress released the patch.

How Does the Attack Work?

The Update Window Is the Attack Window

When WordPress performs a full core upgrade, it downloads a complete copy of the software and extracts it into a temporary staging area. It then moves the files into place. During that staging phase, the original installation script sits in a predictable, web-accessible directory path. An attacker who fires a request to that path during the update can reach the installer. From there, they can reinstall WordPress. This grants them full administrative access to the site and the underlying server.

Why Attacks Scaled So Quickly

The attack requires precise timing, which is why its CVSS complexity rating is classed as high. However, automated scanning tools can monitor thousands of sites simultaneously and fire requests the moment an update begins. Consequently, the technical complexity does not translate into fewer attacks in practice. It simply means threat actors have built tools to handle the timing automatically. As a result, attack volumes reached tens of thousands within a single day of Wordfence disclosing the vulnerability. Most site owners had not yet had a chance to apply the patch.

How Do I Fix This?

The fix is straightforward: update WordPress to version 7.1.4 immediately. The steps below take less than five minutes.

Step 1: Check Your Current WordPress Version

Log into your WordPress dashboard. In the left-hand menu, go to Dashboard and then Updates. Your current version appears at the top of the page. If it shows anything below 7.1.4, your site is vulnerable and needs updating right away.

Step 2: Run the Core Update

Click “Update Now” on the Updates screen. WordPress will download and install version 7.1.4 automatically. In most cases, the update takes under two minutes on a standard hosting account. Moreover, WordPress will show a confirmation screen once the update finishes successfully.

Step 3: Confirm the Update Completed

After the update finishes, return to the Updates screen and confirm it now shows version 7.1.4. For additional reassurance, go to About WordPress in the admin toolbar and verify the version number there. This two-step confirmation rules out update failures that the dashboard does not always flag clearly.

Step 4: Check for Unexpected Administrator Accounts

If your site ran a vulnerable version after October 30, check for signs of compromise. In particular, go to Users in your WordPress dashboard and look for any administrator accounts you do not recognise. An attacker who reached the installer during a previous update window could have created a hidden backdoor account. If you find one you did not create, treat your site as compromised and act accordingly.

What If I Am on Managed WordPress Hosting?

Many managed WordPress hosts apply core updates automatically on your behalf. If your host does this, the 7.1.4 update may already be in place. Even so, still log in and verify the version number. Never assume the update ran. Some hosts require you to opt into automatic major version updates, and others apply only minor security releases automatically. Furthermore, managed updates do not guarantee the update ran before active exploitation began on October 30. Contact your host directly if you are unsure which policy applies to your account.

What Does the CISA Warning Mean for My Business?

The CISA Known Exploited Vulnerabilities catalog is a public register of security flaws. Evidence must confirm real-world attacks before CISA adds a flaw to the list. When CISA adds a vulnerability, it means criminal groups are already using it in live attacks. They are not merely testing whether it works. After all, the catalog gives every organisation a clear signal: the risk is no longer theoretical, it is immediate. CISA ordered US federal civilian agencies to patch this vulnerability by November 6, 2026. That deadline applies only to US government networks. The same flaw, however, sits in every WordPress site running version 7.1.3 or below.

What Should I Do If My Site Was Already Compromised?

What Attackers Could Have Done to Your Site

If your site ran a vulnerable version between October 30 and the moment you applied the patch, attackers may have compromised it before you updated. An attacker who reached the setup-config.php installer could have created a backdoor administrator account. They could also have injected malicious code into your theme or plugin files, or replaced core WordPress files entirely. Furthermore, a standard malware scan will often miss modifications to core files. Most scanning tools only check the uploads folder, themes, and plugins directories.

Your Next Steps After Updating

Simply updating to 7.1.4 closes the vulnerability. It does not remove anything an attacker may have already planted. If you have any reason to suspect your site was targeted, do not update and move on. A thorough professional clean is the only way to be certain that attackers left nothing behind. Visit our emergency WordPress help page. We offer a fixed, transparent price to clean and secure any compromised WordPress site. If you are not certain whether your site was affected, start with our free WordPress security scan. It checks your files and database for signs of compromise.

What is CVE-2026-119977?

CVE-2026-119977 is a high-severity race condition vulnerability in WordPress Core. CVSS scores it at 8.1. It lets an unauthenticated attacker execute code on your server. The attacker times a request to arrive during the brief window when WordPress performs a full core upgrade. WordPress fixed the flaw in version 7.1.4, which shipped on October 28, 2026.

Am I affected if I am running WordPress 7.1.3?

Yes. Security researchers confirmed all versions from 7.0.0 through 7.1.3 as affected. Some researchers report the issue extends back to version 4.7.0 as well. You need to update to WordPress 7.1.4 to remove the vulnerability from your site entirely.

Can an attacker exploit this without an account on my site?

Yes. Exploiting CVE-2026-119977 requires no account on your site at all. The attacker only needs to time a request to coincide with your core update window. Automated tools are already doing this across thousands of sites simultaneously. Attack volumes reached over 18,500 in the first 21 hours after Wordfence disclosed the vulnerability.

How do I know if my site has already been compromised?

Signs of compromise include unexpected administrator accounts in your dashboard and unfamiliar files in your WordPress core directories. You may also notice unexplained changes in site behaviour such as redirects or slow loading. The most reliable check is a thorough malware scan covering core files, plugins, and themes. Our free WordPress security scan checks all three areas.

Does a firewall plugin protect against this vulnerability?

A firewall plugin such as Wordfence can block many exploitation attempts. Wordfence has confirmed it is actively blocking attacks against CVE-2026-119977. However, the safest protection is updating to WordPress 7.1.4. That update removes the vulnerability entirely rather than relying on attack detection.

What does it mean that CISA added this to its Known Exploited Vulnerabilities catalog?

The CISA Known Exploited Vulnerabilities catalog lists flaws where evidence confirms real-world attacks. A listing means attacks are already happening, not that they might happen in future. CISA ordered US federal agencies to patch by November 6, 2026. The same risk applies to every WordPress site on a vulnerable version, worldwide.