WordPress CVE-2026-119977: Listed as Exploited, Update Now

On 3 November 2026 the US cybersecurity agency CISA added CVE-2026-119977, a vulnerability in WordPress itself, to its list of vulnerabilities known to be exploited in real attacks. The fixed version, WordPress 7.1.4, was released on 28 October.

This article is for companies whose website is built on WordPress: what to check first, how to update, and how to look for signs of an attack, step by step. Sites you have left entirely to a web agency are included.

What is the flaw, and why does it matter?

When WordPress updates itself, it first unpacks the new files into a temporary working location called wp-content/upgrade/. The problem was that the name of this location could be predicted in advance, and that on many servers it can be opened from the internet.

The attacker accesses the temporary files in the brief moment between unpacking and deletion. If this succeeds, they may be able to run any code they like on the server, even without logging in. That can lead to damage such as the following.

Affected versions and where to move

WordPress has provided fixes for older branches too, as far back as 4.7. First, check which branch your site is on.

※ WordPress actively supports only the latest version. Treat fixes for older branches as a stopgap; if you can, we recommend going up to 7.1.4.

※ Sites that have not been updated for a long time may also still have other vulnerabilities that were fixed in July 2026 (CVE-2026-60137 / CVE-2026-63030, known as wp2shell, severity 9.8).

Timeline

• 28 October 2026
  WordPress releases 7.1.4 and urges everyone to update right away. Fixes are also provided for branches as far back as 4.7
• 29 October 2026
  WordPress publishes details of the issue (rated "Low")
• 31 October 2026
  Wordfence publishes it as CVE-2026-119977 (CVSS 8.1)
• 3 November 2026
  CISA adds it to the Known Exploited Vulnerabilities list

Six steps to check and respond

1. Find out who manages your site

   Is it someone in-house, a web agency or a maintenance company? If you don't know, look for your server contract or emails from when the site was built.

2. Check the version

   Sign in to the admin screen and open "Dashboard" → "Updates" in the left menu to see the current version. If you can use commands, wp core version also shows it.

3. Take a backup

   Before updating, save both the site's files and its database.

4. If you can, block outside access to the working location

   The update to 7.1.4 is itself carried out by the old version's code. It is safer to deny access to /wp-content/upgrade/ in your server settings before updating. If you are not confident with the settings, leave this step to someone who knows servers.

5. Update to the fixed version, then check the version again

   Go to "Dashboard" → "Updates" → "Update now". Even if automatic updates are turned on, always check on screen that the site is on the fixed version.

6. Look for signs of an attack

   Go through the checklist below. If anything looks wrong, change the administrator passwords and consult a specialist company.

How to look for signs of an attack

Neither WordPress nor Wordfence has published definitive markers such as the attackers' IP addresses. Check the following, focusing on the date and time when the update of WordPress itself ran.

• Does your access log show requests to PHP files inside wp-content/upgrade/ (especially setup-config.php)?
• Inside wp-content/upgrade/, are there any PHP files you don't recognise, or a wp-config.php?
• Are there any administrator accounts you don't recognise?
• Are there plugins you don't remember installing, or PHP files you don't recognise?

A single request in the log does not necessarily mean someone got in. Treat it as one clue and judge it together with the other items.

If a web agency looks after your site

Even if a web agency looks after your website, the site belongs to your company. It is worth asking them:

• What version is our WordPress on now? Is it on the fix for CVE-2026-119977?
• Who updates WordPress itself, and how often?
• Do you update plugins and themes too? Are any of them no longer being developed?
• Where are the backups, and when did you last try restoring one?
• Can we also receive the login details for the admin screen and the server?

WordPress runs on PHP. If the PHP on your server is old, see also "What to Do About the PHP Vulnerability", and if you can't reach your web agency, see "Taking Over a Legacy System With No Documentation". A review of an old site as a whole is covered in "Securing Legacy Systems: Where to Start".

Leave it, or act now?

How Digi Dinos can help

Digi Dinos is a software company with offices in Vietnam and Japan. Over 8 years we have delivered more than 150 projects. Our team works in Japanese.

• WordPress updates and checks: version check, backup, update, check for traces of an attack.
• Taking over maintenance of existing sites: we also review WordPress installations, themes and plugins that are no longer being updated.
• Responding to new vulnerabilities: when a fix like this one comes out, we assess the impact and apply it.
• No documentation? No problem: even when the original vendor is gone and nobody understands the system, we read the code, rebuild the documentation and propose a complete plan.
• Lifetime warranty: if a defect turns up in work we did, we fix it, with no time limit for as long as the maintenance contract continues.

Frequently asked questions