What happened
WordPress 7.1.4, released on 28 October, fixes a flaw in the core update process. During a core update that uses the complete package, WordPress unpacked the new files into a predictable folder that can be reached from the web. An attacker who wins the race against that step could run code on the server during the update, without logging in. On 3 November, CISA added the flaw (CVE-2026-119977) to its Known Exploited Vulnerabilities catalog, the list of flaws used in real attacks.
Who's affected
Sites on WordPress 4.7 through 7.1.3, unless the site already runs the fixed release for its branch (see below).
What to do
Update WordPress. Make a backup first if your service allows it. In the admin area, open the Dashboard, click Updates, then Update Now. You can also download 7.1.4 from wordpress.org. Sites with automatic background updates update themselves, but check that your site now runs a fixed version.
WordPress recommends updating immediately and actively supports only the latest version, 7.1.4. Older branches back to 4.7 also got fixed releases, for example 7.0.8, 6.9.11 and 6.8.12, down to 4.7.39. The full list is in the release notes. WordPress 4.6 and earlier no longer get security updates.
More details
