Ing. Calogero Bono
WordPress 7.1.4 is a security release that came out on October 28, and it includes the fix for a flaw that allows code execution on the server during a core update. The US CISA has confirmed that the vulnerability, CVE-2026-119977, is being exploited and has been added to the KEV catalog. It matters because the attack does not require an account on the site. If you manage WordPress sites, the update cannot wait.
A few terms before we get into the facts. CVE is the code that identifies a known vulnerability. TOCTOU (time-of-check time-of-use) is a race condition, meaning a defect where something changes between the check and the use of a resource. RCE means remote code execution. KEV is the CISA catalog of vulnerabilities whose exploitation is proven. XSS stored is a malicious script saved on the site and served to visitors.
What is the CVE-2026-119977 flaw?
According to the official WordPress announcement, it is a weakness in the update process that can lead to remote code execution during the upgrade window. The report comes from Umut Bayram, a researcher at Picus Security.
As BleepingComputer reports, the problem stems from the use of predictable, web-reachable staging paths during full core updates. The severity is high, with a CVSS score of 8.1 according to The Hacker News, and the complexity of the attack is high.
How much is it really being exploited?
CISA has added the flaw to the KEV catalog and ordered civilian federal agencies to fix it by November 6, 2026. The agency also invited private companies to prioritize the patch.
The numbers come from Wordfence, so they are claims from a security company. BleepingComputer reports 13,095 attacks blocked in 24 hours. The Hacker News cites more than 18,500 requests to "setup-config.php" paths in the first 21 hours and 12,632 attacks blocked in another 24-hour window. Previdian recorded three attempts against its honeypot on October 30.
What else does WordPress 7.1.4 fix?
The release is not just about the upgrade. The official list includes several stored XSS flaws in core blocks and functions.
- the Categories block, the Playlist and Image blocks, the comment pagination blocks
- the Interactivity API, with several XSS issues and a denial of service case
- the Customizer, with an XSS and the discovery of unpublished changesets by anonymous users
- requests to remove personal data and crafted usernames
Also fixed are the reading of notes by privileged users without editing rights and the root certificates, updated for the revocation of eMudhra.
Why is 2026 a difficult year for the WordPress core?
According to BleepingComputer, in July the security team fixed the wp2shell chain, made up of a confusion in the REST API batch routes (CVE-2026-63030) and a SQL injection (CVE-2026-60137). Public exploits arrived one day after the patches.
In September a Chinese-speaking actor used the chain to steal data from more than 18,500 database records of small businesses and public organizations. The precedent shows how short the time between patch and attack can be. To go deeper, our WordPress security guide explains the basic defenses.
Limits to know
We do not know who is behind the attacks or how many sites have been compromised. CISA has not released details on the exploitation, and the figures on blocked attacks come from Wordfence, with different time windows across sources. Fixes for the older branches, down to 4.7, are still on their way and will be released when ready.
What changes for those working in digital
Update to 7.1.4 right away, from the Updates section of the Dashboard, if automatic updates have not already run. If you do not have a procedure, our strategy for updating without breaking the site is a good starting point. Anyone managing many client sites should also check the ones they have forgotten about. A firewall like those compared in the security plugin guide helps, but it does not replace the patch.
Our take
The most uncomfortable part is that the flaw hits exactly the mechanism you would use to protect yourself. Updating is the defense, but during the update the risk window opens. The positive side is the fast response from the security team. The negative side is the pace of 2026, with an exploit chain in July and another flaw exploited in October. Anyone treating updates as something to do when there is time is betting against the numbers.
Frequently asked questions
What does WordPress 7.1.4 fix?
It fixes a code execution flaw in the update process and several stored XSS issues. It also includes the fix for a denial of service case and the update of root certificates.
Does CVE-2026-119977 require an account?
No. According to Wordfence, as reported by the sources, no account is needed. The attacker does, however, have to exploit a short window during a full core update.
When is WordPress 7.2 coming out?
It is expected on December 8. Beta 3 is already available and contains the applicable fixes.
Do older versions also get the patch?
Yes, in part. Fixes are being backported to all eligible branches down to 4.7 and will be released when ready. WordPress reminds users that only the latest version is actively supported.
Does the CISA deadline also apply to Italian companies?
No, the November 6 deadline applies only to US federal agencies. CISA does, however, also urge the private sector to prioritize the patch.
What to watch for in the coming weeks on WordPress
The patch is available, but attention now shifts to the older branches and to the 7.2 beta. The riskiest period is when the exploit is circulating and sites are not yet updated.
- Check when backports for the older versions you still use arrive and plan the migration.
- Read the server logs looking for requests to installation paths such as setup-config.php.
- Follow the notes for Beta 3 and for 7.2, expected on December 8, before updating in production.
