WordPress vulnerability CVE-2026-119977: exploited during updates, move to 7.1.4

The short answer: on 28 October 2026, WordPress released security version 7.1.4, which fixes thirteen issues, including a weakness in the upgrade process that can lead to remote code execution during the upgrade window. On 3 November, CISA added this flaw to its catalogue of exploited vulnerabilities as CVE-2026-119977, with active exploitation confirmed. Morocco’s maCERT (DGSSI) published bulletin 70202910/26 on 29 October, with critical risk and impact. Move to 7.1.4 (or the fixed version of your branch), check that the update has actually applied, then check the server.

In Morocco, a large share of SME showcase sites, recruitment sites and online shops runs on WordPress. These sites are often managed by an agency, a provider who has since left, or an employee, and nobody checks that they update. Here is what WordPress, CISA and maCERT say, and what to do.

What is fixed

The WordPress 7.1.4 announcement describes the first fix as “a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window”. The announcement does not cite a CVE identifier, but CISA’s KEV catalogue links to it for CVE-2026-119977.

The KEV catalogue describes the flaw as follows:

• type: a time-of-check time-of-use (TOCTOU) race condition, classified as CWE-367;
• impact: an unauthenticated attacker can execute code on the server during the upgrade window;
• cause: predictable, web-accessible staging paths used during full-package core upgrades.

In other words, during the few moments when WordPress installs a new version, temporary files can be reached from the internet, and an attacker can take advantage of it. The paradox is real: the site is exposed at the very moment of the core upgrade, as long as it runs an unfixed version.

The other twelve fixes in 7.1.4 cover in particular stored XSS flaws in several blocks, the Interactivity API, Customizer selective refresh and user logins, a disclosure of unpublished changesets, a Notes access issue and a root certificate update.

CISA does not publish a CVSS score in its alert, and the NVD record could not be consulted at the time of writing, so we do not quote any score.

Product	Affected versions (per maCERT)	Fixed version
WordPress 7.1	earlier than 7.1.4	7.1.4 (28 October 2026)
WordPress 7.0	earlier than 7.0.8	7.0.8
WordPress 6.9	earlier than 6.9.11	6.9.11
Older branches	down to 4.7, earlier than 4.7.39	fixed version of the branch

WordPress says the fixes are being backported to all eligible branches, down to 4.7, and that these releases will ship as they become ready. Check that the version for your branch is available on the official WordPress releases page. The safest recommendation remains to move to the up-to-date 7.1 branch.

Active exploitation: what CISA says

CISA added CVE-2026-119977 to its KEV catalogue on 3 November 2026, “based on evidence of active exploitation”. It gives US federal agencies a remediation deadline of 6 November 2026 and requires a forensic review of the affected systems. The catalogue states that use by ransomware groups is unknown to date.

A three-day deadline and a forensic requirement are rare: they mean that an update alone is not enough if the site may have been targeted before it was fixed.

The maCERT bulletin

maCERT bulletin 70202910/26, dated 29 October 2026, is titled “Vulnérabilités critiques dans le CMS WordPress” (critical vulnerabilities in the WordPress CMS). It states that several critical vulnerabilities have been fixed in the WordPress core and refers to the WordPress security release of 28 October. On 2 November, maCERT separately published bulletin 70360211/26 on vulnerabilities affecting several WordPress plugins and themes: both need to be handled.

Interim measures

If the update cannot be done right away (customised site, provider unreachable):

1. Do not rush a core upgrade to an unfixed version: upgrade straight to the fixed version, at a time when you are watching the site.
2. Put a web application firewall (WAF) in front of the site, at your host or through a service such as Cloudflare, and watch for rules published for this flaw.
3. Take a full backup (files and database) stored off the server before any work.
4. Restrict access to the admin area (/wp-admin) by IP address or with additional authentication.

Checks to run

• Check the version under Dashboard > Updates, or with wp core version if you use WP-CLI.
• Check that automatic updates are not disabled by the host, a plugin or a configuration constant (AUTOMATIC_UPDATER_DISABLED, WP_AUTO_UPDATE_CORE).
• List all your WordPress sites, including old campaign sites, test sites and forgotten subdomains: they are often the ones no longer updated.
• Look for recent or unknown PHP files in the site directory, especially in wp-content and wp-content/upgrade.
• List administrator accounts and remove any unknown account.
• Read the server access logs around update dates, looking for requests to temporary directories.
• Update the plugins and themes covered by maCERT bulletin 70360211/26.

Our take for businesses in Morocco

This flaw is a reminder that a showcase website is part of the information system: it carries the company’s name, collects contact data and can be used as a relay for an attack or for phishing. It needs an owner, an inventory of sites, tracked updates and tested backups, just like an internal server.

To go further, read our permanent guide to securing a business WordPress website, our article on the web application firewall (WAF), our guide to Cloudflare for business, our patch management method and our article on immutable 3-2-1 backup. If you suspect a compromise, follow our incident response plan for the first hour. For the organisations concerned, Law 05-20 and DGSSI requirements require maCERT bulletins to be acted on.

How we can help

We inventory your WordPress sites, apply the fixed version, check for suspicious files or accounts, set up off-server backup and a web application firewall, then track versions in our 24/7 monitoring, with critical incidents handled in under 15 minutes. Discover our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.

Sources: WordPress, WordPress 7.1.4 announcement of 28 October 2026, WordPress, list of releases, CISA, alert of 3 November 2026, CISA KEV catalogue, maCERT: bulletin 70202910/26 (WordPress core), maCERT: bulletin 70360211/26 (plugins and themes), MITRE, CWE-367, NVD CVE-2026-119977.