WordPress bug CVE-2026-119977: am I affected, and how do I check my site?
Quick answer
WordPress 4.7 through 7.1.3 has a remote code execution bug that an attacker with no login can try to trigger during the short window while a site is installing a full WordPress update (Wordfence). It’s fixed in WordPress 7.1.4, released Oct 28, 2026, plus backport releases for older branches. It got its CVE ID on Oct 31, and attackers are already probing for it (NVD; The Hacker News). If you run a WordPress site, confirm you’re on a fixed version today.
Am I affected?
Who’s affected
- Self-hosted WordPress sites on 4.7 through 7.1.3 that haven’t installed the fixed release (Wordfence).
- The risky moment is the update itself: the attacker has to win a race while WordPress unpacks a full core update into
wp-content/upgrade/(Rescana). - Not this bug: sites already on 7.1.4 or a fixed backport. If you only read WordPress blogs, there’s nothing for you to do.
How to check (60 seconds)
- Log in to wp-admin and look at Dashboard → Updates, or the version number at the bottom right of any admin page.
- Fixed versions: 7.1.4, plus backports including 7.0.8, 6.9.11, 6.8.12, 6.7.11 and 6.6.11, down to 4.7.39 (Wordfence).
- On managed hosting, check your host’s dashboard. Many push core security releases automatically.
What to do
- Update now if you’re below a fixed version, then reload the Updates page to confirm the new number.
- Block web access to
wp-content/upgrade/in your server config. Security researchers list this as a stopgap (Rescana). - Check your access logs for requests to
setup-config.phpunderwp-content/upgrade/. That’s the pattern attackers are probing (Wordfence). - In wp-admin, look for admin users, plugins or PHP files you don’t recognize. If you find any, restore from a clean backup and change passwords.
- Using Wordfence Free? Its firewall rule for this reaches free users Nov 27, so patching is your protection until then (Wordfence).
What happened
- Oct 28: WordPress 7.1.4 shipped, fixing 22 vulnerabilities including this one (Wordfence).
- Oct 28–29: Wordfence saw more than 18,500 requests aimed at staged installers in 21 hours (Wordfence).
- Oct 31: the bug was published as CVE-2026-119977. The Hacker News reported 62,969 blocked attempts in 24 hours (Rapid7; The Hacker News).
Why it matters
- WordPress runs a huge share of the web, so mass scanning starts fast once a fix is public.
- Ratings differ: Wordfence, which assigned the CVE, scores it 8.1 (High), while WordPress rates it Low because of the timing needed (Rapid7; Severity Daily). Either way, it’s a one-click update.
- None of the sources we checked report a confirmed successful break-in.
FAQ
- Is WordPress.com affected? This is about self-hosted WordPress core. Check with your host if you’re unsure who manages updates.
- Do plugins matter here? Not for this bug; it’s in WordPress core. The same release fixed 21 other issues, so update anyway.
- Will auto-updates cover me? Minor security releases install automatically on most sites unless auto-updates were turned off. Confirm the version to be sure.
- Is it being exploited? Attack attempts are being blocked at scale; no confirmed successful compromise has been reported.