WordPress announced a security fix on October 28. About three hours later, attackers were already trying to exploit the flaw it fixes.
This one lives in WordPress core, the software itself, rather than in a plugin or theme. It can also be exploited at an odd moment: while your site is running a core update.
If your website runs on WordPress, here’s what happened, who’s responsible for what, and a short check to run once your update is done.
The Current WordPress Vulnerability
On November 3, CISA added the flaw to its Known Exploited Vulnerabilities catalog, which means it has evidence of real attacks. Wordfence, the company behind a popular WordPress firewall, reported blocking about 13,000 attacks in a single 24-hour period.
The flaw is tracked as CVE-2026-119977. In plain terms, when WordPress runs a full core update, it stages files in locations that attackers can predict and reach from the web. If an attacker hits the right spot at the right time, they can run their own code on your server without ever logging in.
It affects every WordPress release from 4.7 through 7.1.3, which covers nearly ten years of versions. WordPress 7.1.4, released October 28, fixes it. WordPress has also been backporting fixes to older branches, so check whether yours has one.
Some perspective before anyone panics. The attacker has to catch that short update window, and Wordfence rates the attack complexity as high. Nobody has said how many sites were compromised, and CISA hasn’t shared details on the attacks. So this is a reason to check your site, and no reason to assume the worst.
Not sure which version of WordPress, or which plugins, your public site is running? A vulnerability scan shows you what an attacker sees from the outside, including outdated software. Let’s talk about what that looks like for your site.
Before You Update, Find Out Who’s In Charge
A WordPress site has four different owners hiding in it
First, there is WordPress core. The WordPress project writes and ships the fix. Whether your site gets it depends on your update settings. Many sites receive security releases automatically, but some hosts and developers switch that off to avoid surprises.
Then, there are plugins and themes. These update on their own schedule, and each one is its own risk. A fully patched core won’t protect an outdated contact form plugin.
Next, there’s your host. Managed WordPress hosts often handle core updates, PHP versions, and firewall rules for you. Cheaper shared hosting usually leaves most of that to you. The PHP flaws we covered last month sit one layer below this one, and they land on the same person. Ask your host which parts they cover, and get the answer in writing.
Finally, there’s you or your web developer. Everything the host doesn’t handle ends up here. If a developer built the site years ago and nobody has talked to them since, that’s the first conversation to have.
A short check after you update
- Confirm the version: In your WordPress dashboard, go to Updates and check that you’re on 7.1.4 or the patched release for your branch.
- Look at your admin accounts: Under Users, filter by Administrator. Any name you don’t recognize needs an explanation.
- Look for files you don’t recognize: Your uploads folder should hold images and documents, not PHP files. Unfamiliar PHP files anywhere, or files changed around the time of your update that you can’t explain, deserve a closer look. Your host or developer can help with this one.
- Run a malware scan: A security plugin or your host’s scanner will catch the obvious problems.
- Update your plugins and themes too: There may be plugins that need to be updated with the latest WordPress update.
If something looks wrong, don’t start deleting files. Call your host or IT provider first, change the passwords for your admin accounts and your hosting login, and check how quickly your cyber insurance policy wants to hear about an incident. A backup you’ve tested is the cleanest way back.
Check Your Version Today
The fix has been out since October 28, and attackers have had a head start on every site that hasn’t checked. Open your dashboard and look at the version number. You’ll know where you stand in about a minute.
If you’d like a second set of eyes on what your site is exposing, we’re glad to help. MainNerve has been doing this work for over 20 years. Reach today for a free consult.
