On November 3, 2026, CISA added CVE-2026-119977 - a WordPress Core flaw that lets attackers run code on a website while it’s updating itself - to its Known Exploited Vulnerabilities catalog, confirming active attacks in the wild. If your business or nonprofit site runs WordPress, confirm this week that it’s on version 7.1.4 or a backported security release.
Quick answer: CISA confirmed on November 3, 2026 that attackers are actively exploiting CVE-2026-119977, a flaw in WordPress’s own update process that can let them run code on a site during the brief window while an upgrade is running. Wordfence has blocked more than 240,000 exploit attempts since the flaw was disclosed on October 28. The most important action: confirm your site is on WordPress 7.1.4 or a backported security release, and check for signs someone got in during a past update.
What happened?
On October 28, 2026, the WordPress security team released version 7.1.4 and described the problem plainly: “A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window.” They recommended updating immediately.
The flaw, tracked as CVE-2026-119977, is a race condition in how WordPress updates itself. During a full-package core upgrade, WordPress briefly stages installer files in a predictable, web-accessible spot on the server. An attacker who probes a site at just the right moment can potentially reach those staged files and run code on the server without logging in. Wordfence, which rates the flaw 8.1 out of 10 (high severity), says it affects WordPress versions 4.7 through 7.1.3 and credits its discovery to Picus Security researcher Umut Bayram.
Six days later, on November 3, CISA added the flaw to its Known Exploited Vulnerabilities catalog - the list reserved for vulnerabilities with confirmed real-world attacks - and gave federal agencies until November 6 to remediate. While the directive binds only federal agencies, CISA urged all organizations, private sector included, to prioritize patching.
The attacks are automated and ongoing. Wordfence reported that probing began the same day the flaw was disclosed, that it blocked more than 240,000 exploit attempts in the first week - over 74,000 on October 30 alone. The attack is high-complexity - it must land inside a short upgrade window - but attackers can probe millions of sites for free.
Why does this matter for small businesses?
For Pennsylvania small businesses and nonprofits, three parts of this story matter.
WordPress is small-business infrastructure. It’s one of the most widely used website platforms anywhere, and especially common for small business and nonprofit sites - often built years ago by a contractor or an employee who has since moved on, leaving nobody actively responsible for them.
The flaw hides inside the task you do on purpose. The standard advice - keep your software updated - is still right. But this flaw lives inside the update process itself: the moment a site is doing the responsible thing, it’s briefly more exposed. The patched versions change how upgrades stage their files so that window can’t be abused - which is why updating matters even for self-updating sites.
Small sites aren’t targeted personally; they’re swept automatically. BleepingComputer’s reporting on the July 2026 “wp2shell” flaw chain is the context: public exploits appeared one day after WordPress patched it, and by September a threat actor had used them to steal more than 18,500 records from small businesses and government organizations. Attackers sweep the internet automatically for unpatched sites; organizations without a maintenance plan are the ones still exposed.
What should you do this week?
-
Find out what your website runs - and what version. Ask whoever maintains your site: “Are we on WordPress, and are we on 7.1.4 or later?” If the answer is “I’m not sure,” that’s your finding.
-
Update to a patched release. WordPress 7.1.4 (released October 28, 2026) carries the fix, and it was backported to older branches - 7.0.8, 6.9.11, and earlier, back to 4.7.39 - so a site doesn’t need the latest major version to be protected. Given confirmed active exploitation, this is a this-week task.
-
If you use a web application firewall, confirm it covers the upgrade path. Wordfence says blocking these probes requires its firewall to run in Extended Protection mode, because the targeted staging files don’t load WordPress itself. If your site runs Wordfence, check that setting; if you rely on your host’s protections, ask them what they’ve done about this flaw.
-
Do a quick compromise check. The risk existed during past upgrade windows. Look for administrator accounts nobody recognizes, plugins nobody remembers installing, and files in unexpected places. If you don’t know what “normal” looks like, hand this to your IT partner.
-
Put the site on a maintenance schedule. The recurring lesson in these CISA alerts - Magento stores breached months after a patch shipped, WordPress servers breached days after exploits went public - is that small organizations get hit through known, fixable flaws. Routine upkeep, not heroics, is what prevents it.
Frequently asked questions
My website runs WordPress. How do I know if it’s affected? The flaw affects WordPress versions 4.7 through 7.1.3. It was fixed on October 28, 2026 in WordPress 7.1.4, and backported to older branches, including 7.0.8, 6.9.11, and 4.7.39. If your site is on 7.1.4 or a backported security release, it’s protected. If you’re not sure, ask whoever maintains the site what version it runs.
How are attackers actually using this flaw? It’s a race condition in WordPress’s own update process. During a full-package core upgrade, WordPress briefly stages installer files in a predictable, web-accessible location, and an attacker who reaches them at the right moment can run code on the server without logging in. Wordfence has blocked more than 240,000 exploit attempts since the flaw was disclosed on October 28, 2026.
Does the November 6, 2026 deadline apply to my business? No. That date applies to US federal civilian agencies under CISA’s Binding Operational Directive 26-04. CISA urged all organizations, including private-sector ones, to prioritize patching - so treat it as a sensible benchmark, not a reason to wait.
My site updates itself automatically. Am I safe? If your site is now on WordPress 7.1.4 or a backported security release, the vulnerable update behavior is fixed going forward. The exposure existed during past upgrade windows, so confirm the update completed and check for unfamiliar administrator accounts, plugins, or files.
We don’t run WordPress. Does this alert matter for us? Not directly - but the pattern does. Attackers consistently breach small organizations through known, already-patched flaws, and websites are a common blind spot because no one owns their upkeep. Whatever platform your site runs on, confirm someone is applying security updates on a schedule.
Where does Merit IT fit in?
Websites are the piece of small-business IT that most often runs on autopilot - built once, then quietly aging. Keeping them patched, monitored, and backed up is unglamorous work, and it’s exactly what our IT support practice handles for small businesses and nonprofits across Pennsylvania, month-to-month with no long-term contract.
Get a free technology assessment - we’ll review your website’s patch status along with the rest of your environment and give you a clear picture with no obligation. Or keep reading on the Merit IT blog for more practical, no-hype IT guidance.