WordPress 7.1.4 Fixes an Unauthenticated Update-Time RCE Attackers Are Already Probing: Check Your Version

TL;DR: WordPress 7.1.4, released on October 28, 2026, fixes 22 security flaws. The worst lets an attacker with no account run code on the server, but only during a short window while WordPress unpacks a full core update. Wordfence says attackers began probing for it within minutes of its firewall rule going live. It’s now being actively exploited: CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on Nov 3, 2026. Every branch from 4.7 to 7.1 got a fixed release. Check that your site actually updated.

What happened

On October 28, 2026, WordPress released version 7.1.4 as a security release and told site owners to update immediately. Its release notes count 22 vulnerabilities. The list includes many stored cross-site scripting (XSS) issues, most needing a Contributor account or higher, plus a leak of unpublished Customizer changes to logged-out visitors. It also covers “a race condition during core updates that could lead to remote code execution,” reported by Umut Bayram.

Wordfence explained that flaw on October 29. During a core update that uses a complete WordPress package, versions 4.7 to 7.1.3 unpack the new files into a predictable folder under wp-content/upgrade, and that copy includes the WordPress installer. On many servers the folder can be reached from the web. An attacker who requests the staged installer at the right moment can move on to running PHP code. Wordfence rates it 8.1 (High) and calls the attack complexity high: in its lab tests the window lasted only seconds.

Attackers are trying anyway. Wordfence says the first hit on its new firewall rule came nine minutes after it went out at 20:30 UTC on October 28 (4:30 a.m. October 29, Manila). It logged more than 18,500 requests to staged setup-config.php paths in the first 21 hours. Two of the biggest sources kept polling small groups of sites for about 14.5 hours, which Wordfence says fits an attempt to catch the update window. Wordfence’s post doesn’t report a confirmed compromise. The flaw is now tracked as CVE-2026-119977: Wordfence published the CVE record on Oct 31 and rated it CVSS 8.1 (High). CISA added it to its Known Exploited Vulnerabilities catalog on Nov 3, 2026, based on evidence of active exploitation.

WordPress 7.1.4 fixes the flaw by randomizing the staging folder, adding an index guard and blocking unsafe use of staged configuration data. The fixes were backported to every branch back to 4.7, and WordPress’s update API offered all 25 fixed releases at our check. WordPress 4.6 and older no longer get security updates.

Why it matters

Our read: most WordPress sites update minor releases on their own, so many are already fixed. The risk sits with sites where automatic updates are off, broken or blocked by the host. Those are often small business sites that nobody has logged into for months. The exploit needs luck, but attackers are automating that luck. And the other 21 flaws are worth closing too, especially on sites with several editors or guest authors. It’s another week where the web stack under a small site needed fast patching, after PHP’s October 21 critical fixes.

What to do now

1. Check your version. Open Dashboard › Updates, or run wp core version. You want 7.1.4, or the security release for your branch.
2. Update if you’re behind. Click Update Now, or run wp core update. Take a backup first if you can.
3. Know your branch’s fixed version. The fixed releases are 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18, 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28, 5.0.31, 4.9.35, 4.8.34 and 4.7.39.
4. If you run Wordfence, check that the firewall is set to Extended Protection. Free users won’t get this rule until November 27.
5. If your site was behind, look for requests to PHP files under wp-content/upgrade in your logs, plus admin accounts, plugins or PHP files you didn’t add. Then run a scan.

Our tip: to apply only security and maintenance releases on your current branch, without jumping to a new major version, run wp core update --minor, then wp core version to confirm. If you look after several client sites, a quick wp core version loop over them (or your management dashboard’s version column) shows the laggards in a minute. For more patch guides, see our security hub.

Sources & method

Source	What it confirms	Link
WordPress 7.1.4 announcement (Oct 28, 2026)	Security release, update-immediately advice, the upgrade-process RCE and its reporter, backports to branches through 4.7	WordPress.org
Version 7.1.4 release notes (Oct 28, 2026)	22 vulnerabilities, the full fix list, which branches are affected and each branch’s fixed version, 4.6 and earlier unsupported	WordPress.org
WordPress update API	All 25 fixed releases, 4.7.39 to 7.1.4, offered at our check	WordPress.org API
Wordfence (Oct 29, 2026)	How the race works, CVSS 8.1, exploit attempts (18,500+ requests in 21 hours), firewall rule dates, the steps for site owners	Wordfence
Wordfence Intelligence entry	Affected range 4.7.0 to 7.1.3, patched versions, attacks blocked in the past 24 hours (70,778 read Oct 31; 15,570 read Nov 3)	Wordfence
CVE-2026-119977 record (published Oct 31, 2026)	CVE ID, assigned by Wordfence, CVSS 8.1 (High), affected 4.7.0 to 7.1.3, finder Umut Bayram	CVE.org
NVD entry for CVE-2026-119977	NVD listing of the same record	NVD
CISA Known Exploited Vulnerabilities catalog	CVE-2026-119977 added Nov 3, 2026 (active exploitation); FCEB due date Nov 6, 2026	CISA
SecurityWeek (Oct 30, 2026)	Independent coverage	SecurityWeek

Last checked: Nov 4, 2026, 7:21 a.m. Manila (UTC+8). Method: We read WordPress’s announcement and release notes, checked the fixed releases in WordPress’s update API, and read Wordfence’s analysis and its vulnerability entry (entry last read by our team at 11:45 a.m. Manila on Nov 3). On Nov 3 we read the CVE-2026-119977 record at CVE.org and NVD and checked CISA’s Known Exploited Vulnerabilities catalog. On Nov 4 we checked CISA’s KEV catalog and its Nov 3 alert. Steps marked “Our advice”, tips marked “Our tip” and analysis marked “Our read” are ours, not WordPress’s or Wordfence’s. The thumbnail is an original OneSignalDesk card summarizing WordPress’s release notes and Wordfence’s analysis. No affiliate links. How we work.

Updates

• Nov 4, 2026, 7:21 a.m. Manila: CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on Nov 3, 2026, citing evidence of active exploitation. It set a Nov 6, 2026 remediation due date for US federal civilian (FCEB) agencies. The fixed versions are unchanged: 7.1.4, 7.0.8, 6.9.11 and the backports. Wordfence’s post still doesn’t report a confirmed compromise.
• Nov 3, 2026, 11:56 a.m. Manila: The flaw now has an ID: CVE-2026-119977. Wordfence published the CVE record on Oct 31 at 1:33 p.m. Manila and rated it CVSS 8.1 (High). It isn’t in CISA’s Known Exploited Vulnerabilities catalog. WordPress’s update API still offers 7.1.4 as the newest release, along with the same 25 fixed releases, and there’s no 7.1.5. Wordfence’s vulnerability entry said “Wordfence blocked 15,570 attacks targeting this vulnerability in the past 24 hours” when our team read it at 11:45 a.m. Manila on Nov 3 (Wordfence’s figure, down from 70,778 on Oct 31).
• Prepared Oct 31, published Nov 3, 2026: These edits were prepared on Oct 31 but first went live on Nov 3. When we read Wordfence’s vulnerability entry at 7:39 a.m. Manila on Oct 31, it said Wordfence had blocked 70,778 attacks targeting this flaw in the past 24 hours. We also fixed how we described Wordfence’s firewall advice (it says the firewall should, not must, run in Extended Protection mode), added a tip on wp core update --minor and corrected the spelling of “randomizing.”
• Oct 30, 2026, 11:00 p.m. Manila: First published. We’ll add a dated note if a CVE ID is assigned or Wordfence reports confirmed compromises.