If your business website runs on WordPress, update it to a patched release now. On 3 November 2026 the US cyber agency CISA added a WordPress core flaw, CVE-2026-119977, to its list of vulnerabilities that attackers are already exploiting. The fix shipped on 28 October in WordPress 7.1.4, and older branches have their own patched releases.
This is a WordPress security update that matters even if you never installed a risky plugin. The weak spot is in WordPress itself, in the moment it updates itself.
What is confirmed, what is reported, what is unknown
| Status | Detail |
|---|---|
| Confirmed | WordPress released 7.1.4 on 28 October 2026 as a security release. Its notes list “a race condition during core updates that could lead to remote code execution”, reported by researcher Umut Bayram. WordPress release notes |
| Confirmed | CISA added CVE-2026-119977 (“WordPress Core Time-of-check Time-of-use Race Condition”) to its Known Exploited Vulnerabilities catalogue on 3 November 2026, “based on evidence of active exploitation”. CISA alert |
| Reported, not independently checked by us | Technical write-ups, such as one from Picus Security, say a temporary folder used during updates can be reached from the internet, and that the CVSS severity score is 8.1. We have not tested any of this. |
| Not yet clear | Who is exploiting it, how many sites are hit, and exactly which sites are exposed. Treat this as a developing story. |
Why this one is unusual
Most WordPress attacks go through a plugin or a stolen password. This one targets the update process. When WordPress updates itself, it unpacks the new version, copies files and swaps them in. That takes a short time, and a “race condition” means an attacker who times a request badly or cleverly during that window can interfere with the process. WordPress says this can lead to remote code execution, which means running the attacker’s own code on your server.
The slightly awkward part, according to the Picus analysis, is that the update that fixes the flaw still uses the old updater to install itself. That is why the same write-up suggests extra care while updating. We cannot verify that claim ourselves, so follow WordPress’s own instructions first.
Who is affected
Anyone running a self-hosted WordPress site on a version that has not received the October fixes. The WordPress notes say 22 issues were fixed in this release and that patched versions exist for every branch back to 4.7, for example 7.0.8, 6.9.11 and 4.7.39. WordPress 4.6 and earlier no longer receive security updates. WordPress also states that only the most recent version is actively supported.
Many Nigerian small businesses run WordPress for a company site, a shop or a school page. These are often built once and then left alone. Those are the sites most likely to be behind on updates.
What to do now
- Take a backup first. Files and database, stored somewhere other than the same server.
- Check your version. Log in and open Dashboard, then Updates.
- Update to the latest release for your branch. WordPress says sites with automatic background updates will update on their own, but do not assume. Look at the version number yourself. Download links are on the WordPress releases page.
- Consider blocking web access to the
wp-content/upgrade/folder before you update. This is the mitigation suggested in the Picus write-up. Ask your host or developer to do it properly, because a wrong rule can break the update. - After updating, look for signs of trouble. Check for admin users you do not recognise, files changed recently that you did not change, and a site that suddenly shows an installation screen. CISA’s own guidance says that if you patched after exploitation began, you should check for compromise too.
- If anything looks wrong, change all admin passwords and any database credentials, and get a professional to clean the site.
- If you are on a very old version, plan a move to a supported release. Old versions with no fix are a long-term risk.
Our view (opinion)
This story is a reminder that “I never touch my website” is not a safe position. A site that nobody maintains is a site that nobody is watching. The cost of an hour of monthly maintenance is small. The cost of a hacked company website, with your name and your customers’ trust on it, is much higher.
If you do not have someone who looks after your site, that is the real gap to fix this week. Our Tech Concierge service includes technical support for websites, and our web development work includes maintenance and support. We have not seen the exploit in any client system, and nothing here claims otherwise. Our earlier post on AI agents covers another area where small teams need clear rules about who is in charge.
Frequently asked questions
Is my WordPress site affected by CVE-2026-119977?
If you run self-hosted WordPress and have not applied the October 2026 security release for your branch, treat it as affected. Check the version in Dashboard, then Updates.
Is this a plugin problem?
No. WordPress lists it as a core issue, fixed in 7.1.4 and the older-branch releases.
Does WordPress.com or my hosting company handle this for me?
We cannot say for every host. Ask your host in writing whether they have applied the October 2026 core security release to your site.
Where is the official fix?
In the WordPress 7.1.4 announcement, with the full list in the release notes.
This story was developing when we wrote it on 7 November 2026. Check the official links above for updates.
Not sure which WordPress version your site is on, or who is looking after it? Book a free 15-minute call and we will tell you what to check first.