On 3 November 2026 the US agency CISA added a security flaw in WordPress core (CVE-2026-119977) to its catalogue of actively exploited vulnerabilities. It sits in the WordPress update process itself and, according to the WordPress team, can lead to code running on the server. The fix has been available since 28 October 2026 in WordPress 7.1.4. This matters for every business whose website runs on WordPress and does not update automatically.
What happened?
On 28 October 2026 WordPress.org released the security version 7.1.4. It closes about a dozen issues, including several cross-site scripting flaws in blocks, the Customizer and the Interactivity API. One of them affects the upgrade process and, according to the WordPress team, can lead to malicious code being executed during the upgrade window. The team recommends updating sites immediately.
According to a BleepingComputer report of 4 November 2026, CISA confirmed on 3 November that this flaw is being exploited in attacks. A researcher at Picus Security reported it. The outlet describes the attacks as technically demanding: the attacker needs no access to the website, but has to strike in the short moment when WordPress is updating itself. Per that report, the security company Wordfence counts roughly 13,000 blocked attack attempts within 24 hours.
CISA's deadlines apply to US federal agencies and do not bind businesses in Germany. The agency does, however, urge organisations outside the federal government to prioritise the fix as well.
What does this mean for your business?
If your website runs on WordPress, you should know which version is installed. For sites with automatic updates switched on, WordPress.org says it delivers the security version by itself. The fixes have also been backported to older version branches, down to 4.7. According to WordPress.org this process is still rolling out. If your installation is very old, a backport may be delayed or never arrive.
Sites that nobody checks regularly are most exposed. That is common among small businesses: the website was set up years ago and has run quietly ever since.
What should you do now?
- Check the version. In the WordPress dashboard, under Dashboard, Updates, you can see which version is running and whether an update is available.
- Update. Install security version 7.1.4 or the fix for your version branch. Take a backup of files and database first.
- Ask your host if you have no dashboard access yourself. With managed hosting the provider often handles this.
- Watch for anything unusual: unknown administrator accounts, unfamiliar files, a suddenly slow site or messages from your host. If you suspect a problem, involve your host or an IT professional.
- Keep plugins and themes up to date too. Core is only one part of the attack surface.
If you have a website that nobody maintains any more, the real question is whether to have it looked after on an ongoing basis or to rebuild it. Both are legitimate.
What is still open?
We have no information on confirmed break-ins through this flaw; BleepingComputer reports attack attempts, not proven compromises. We had no notice from the German Federal Office for Information Security (BSI) at the time of writing. How far the backports for older version branches have been delivered keeps changing. This article is current as of 5 November 2026. It is general information, not individual IT security advice. The PHP flaw from October is a separate topic, covered in our article on the PHP security release.
How can KSTAQ help?
At KSTAQ in Dortmund we keep websites up to date as part of our care plan and check which technology they run on. If your WordPress site is showing its age anyway, a new website may be the more sensible answer. Send us a short note about what you use and we will tell you what to do.