WordPress shipped version 7.1.4 on October 28, 2026, a short-cycle security release that Wordfence says fixes 22 security vulnerabilities, and attackers wasted no time going after the worst of them. CVE-2026-119977 (CVSS 8.1 per Wordfence) is an unauthenticated remote code execution race condition in the core upgrade process that affects every release from 4.7 through 7.1.3. Wordfence’s first firewall hit came nine minutes after it deployed a blocking rule, and it logged more than 18,500 requests aimed at the vulnerable staging paths in the first 21 hours. No confirmed site takeovers have been reported, but for anyone who manages client WordPress sites, here’s how the bug works, what to check, and why “it auto-updates” isn’t the whole answer.
A Race Against the Upgrade Window
The bug lives in how WordPress handles a full-package core upgrade. During that process, WordPress unpacks the new release into a staging folder under wp-content using predictable, web-accessible paths. For a few moments, staged installer files sit there where anyone can request them directly, without loading WordPress at all. An attacker who hits the right file at the right moment can execute code on the server.
The catch, for attackers, is timing. Wordfence says the vulnerable directory “normally remained available for only seconds” in lab testing, and WordPress itself rates the issue Low. Patchstack scored it as high attack complexity and said it “would not call it practical to exploit,” as Rescana’s roundup notes. That doesn’t mean attackers aren’t trying.
Attackers Are Already Polling
Wordfence’s telemetry shows a deliberate effort to catch sites mid-update:
- Fast start: the first matching request arrived nine minutes after Wordfence deployed its rule on October 28.
- Sustained polling: two of the largest sources repeatedly hit small groups of sites for roughly 14.5 hours, behavior Wordfence calls “consistent with trying to catch the brief upgrade window.”
- Growing volume: Wordfence’s vulnerability page later showed 45,055 blocked attacks over a rolling 24-hour period as of October 31, according to BreachNews.
- No confirmed compromises: every source so far describes attempts, not successful break-ins, and the CVE is not on CISA’s KEV list.
The irony is hard to miss: the moment a site applies the fix is exactly the moment the old bug is exposed. Sites that update during heavy polling are the ones at risk.
What Else 7.1.4 Fixes
CVE-2026-119977 gets the headlines, but the release notes are long. Among the other fixes credited by the WordPress security team:
- Stored XSS, lots of it: issues in block markup, the Interactivity API, Customizer selective refresh, the Categories, Playlist, image, and comments pagination blocks, crafted user logins, and privacy data removal requests.
- Information exposure: unpublished Customizer changesets could be discovered by unauthenticated users, and Notes could be read by privileged users without edit access to the post.
- Denial of service: a stored DoS issue in the Interactivity API.
- Trust store update: bundled root certificates were refreshed to reflect the eMudhra revocation.
Fixes were backported to every branch still eligible for security updates, back to 4.7, with patched versions including 6.8.12, 6.9.11, 7.0.8, and 7.1.4.
Your Action Checklist
- Verify, don’t assume: WordPress says sites with automatic background updates will update themselves, but confirm every site you manage is on 7.1.4 or its branch’s fixed release.
- Block the staging folder: deny web access to the upgrade staging directory inside wp-content at the web server or WAF, as Rescana recommends. Nothing legitimate needs to fetch it over HTTP.
- Check WAF coverage: Wordfence Premium, Care, and Response customers got the rule on October 28; Wordfence Free users get it November 27 under the standard 30-day delay. Wordfence also says the firewall must be optimized with Extended Protection to catch direct PHP requests.
- Review logs: look for requests to staged installer files around your recent update times and investigate anything that returned a success code.
Looking Ahead
WordPress 7.2 is planned for December 8, and Beta 3 already carries these fixes. Expect researchers and attackers alike to keep studying the update pipeline now that a race in it has been shown to matter, and expect Wordfence’s free-tier rule date of November 27 to be a quiet milestone for the long tail of unmanaged sites.
For MSPs, the bigger takeaway is architectural: update mechanisms are attack surface too. Locking down web access to staging and temp folders, scheduling core updates during low-traffic windows, and keeping a WAF in front of client sites turns a seconds-long race into one attackers simply can’t win.
Sources:
- WordPress.org, October 28, 2026
- Wordfence, October 29, 2026
- Rescana, October 31, 2026
- BreachNews, October 31, 2026
