CVE-2026-119977, a WordPress core vulnerability, is being exploited in the wild. It lets an attacker run code on your web server without logging in, and it affects every version from 4.7 up to and including 7.1.3. Upgrade to 7.1.4. Then find out how many WordPress sites your organisation actually runs, which is usually the harder question.
What is the WordPress vulnerability CVE-2026-119977?
WordPress shipped version 7.1.4 as a security release on 28 October. The headline fix addresses a weakness in WordPress's own upgrade process that can lead to remote code execution while an upgrade is running. The same release carries more than ten further security fixes, mostly for stored cross-site scripting, along with an update to the bundled root certificates.
The Dutch National Cyber Security Centre (NCSC) published an alert on 4 November that ties the flaw to CVE-2026-119977 in WordPress Core 4.7 to 7.1.3. It describes a race condition. During the brief moment in which WordPress updates itself, an attacker with no account can execute malicious code on the server, provided they act within a small time window. The NCSC says the flaw is already being exploited.
Don't be reassured by "low likelihood"
The NCSC gives the flaw a risk score of 8.1, rating the likelihood of exploitation as low and the potential damage as high. Read only the first half of that and you might park it until next month's patch cycle.
That would be a mistake. A low likelihood reflects how awkward the attack is to pull off. The same alert says it is happening anyway. And the damage goes well beyond a defaced homepage. Code execution on your web server means the attacker can do whatever that server can: read the forms that collect personal data, use the connections to your CRM or applicant tracking system, pick up API keys left in a config file. My advice is to treat this as an actively exploited critical flaw and give it the turnaround that deserves.
Do you know where all your WordPress sites are?
The inventory is where most organisations come unstuck. The main corporate site is usually in the asset register and inside the scope of the annual pen test. WordPress also turns up in places security never looks: the campaign microsite marketing commissioned two years ago, a subsidiary's careers site, an events page on a stray subdomain, hosted by whichever web agency won the work at the time.
Sites like these rarely have an owner in IT. Marketing pays the invoice, the agency maintains them when asked, and nobody is quite sure whether automatic updates are switched on. When a flaw like this lands and the CISO asks whether you are exposed, the truthful answer is often that someone will have to find out.
My view is simple. If a site runs on your domain, it belongs in your vulnerability management programme, whoever paid for it. To an attacker it is just another of your servers.
Is upgrading enough?
On the 7.1 branch, 7.1.4 is the fix. WordPress says sites with automatic background updates will start the upgrade on their own. Check that it actually completed, though. Automatic updates that someone disabled, or a plugin that gets in the way, only show up when you go and look.
Older versions are messier. When it released 7.1.4, WordPress said the fixes would be backported as a courtesy to every branch still receiving security fixes, currently back to 4.7, but that those backports were still in progress. Only the latest version is actively supported. If you are on an older branch, check whether a patched release for your version has appeared yet. If not, moving to 7.1.4 is the safer route, even if it means testing your theme and plugins first.
There is a further wrinkle. The flaw sits in the update process itself, and the NCSC reports active exploitation. If your site was vulnerable and exposed before you upgraded, the patch closes the hole but tells you nothing about what happened beforehand. Ask whoever runs the site to look for unfamiliar files, new administrator accounts and new scheduled tasks. If anything looks off, bring in someone with DFIR experience before you put the site back into normal service.
What to do this week
- List every WordPress installation across your domains and subdomains, including those run by an outside agency.
- Record the version and the owner of each site. Anything below 7.1.4 gets the upgrade, or a patched release for its branch, today.
- Check that automatic updates are enabled and that the upgrade really went through.
- Have any site that was vulnerable and publicly reachable checked for signs of compromise.
- Agree a named owner for each site going forward, with a firm deadline for applying critical updates.
This is the third time in a few weeks that the same pattern has come up. With PHP2Shell and the GitLab flaw, the fix was available quickly too. Working out where everything ran, and who would pick it up, is what ate the time.
Who you need for this
Your web team or agency can handle the upgrade. The question behind it needs someone else. If you want a complete picture of what you expose to the internet, and every critical flaw pushed through to the last server within an agreed deadline, you need a specialist in vulnerability management. Where your WordPress estate includes custom plugins and integrations, add an application security specialist to that.
Through MVPeople we place interim security professionals for exactly this kind of work. Short of that capacity right now? Call or email me via our contact page and we can work out what you need.
