CISA Confirms Hackers Are Exploiting WordPress Core Flaw: Check Your Site Is Patched

The United States Cybersecurity and Infrastructure Security Agency (CISA) has added a flaw in WordPress Core to its Known Exploited Vulnerabilities catalogue, citing evidence that it is being actively exploited. If your business website runs on WordPress and has not yet been updated, this is the point at which checking stops being routine housekeeping and becomes urgent.

The flaw, tracked as CVE-2026-119977 and rated 8.1 (High) on the CVSS scale, is a time-of-check time-of-use race condition in the WordPress Core update process. In plain terms, during a full-package Core update, WordPress unpacks the new files into a temporary staging directory beneath wp-content/upgrade. On many servers that directory is web-accessible, and CISA says the flaw is “due to predictable, web-accessible staging paths used during full-package core upgrades”. An attacker who requests the staged installer at precisely the right moment could run code on the server, and no account on the site is needed.

Patches for the flaw were released late last month. WordPress 7.1.4, released on 28 October 2026, fixed 22 security vulnerabilities in WordPress Core, and the fix was backported to affected branches going back to WordPress 4.7. The patched versions include 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11 and 4.7.39. Sites running WordPress 4.6 or earlier no longer receive security updates at all and should be upgraded to a supported release.

What has changed since the release is the evidence that attackers are not just probing for this flaw, but actively using it. According to The Hacker News, reporting CISA’s announcement on 4 November 2026, Wordfence recorded more than 18,500 requests targeting staged setup-config.php installer paths during the first 21 hours after public disclosure, and 12,632 attacks attempting to exploit the flaw had been blocked in the 24 hours before publication. Telemetry from Previdian recorded three exploitation attempts against its honeypot sensors from an IP address geolocated in the United Kingdom, observed on 30 October 2026.

CISA’s listing sets a deadline of 6 November 2026 for United States federal civilian agencies to apply the fixes. That deadline does not apply to UK small businesses, but it underlines how seriously the flaw is now being treated: a vulnerability moves onto CISA’s exploited list only once there is evidence of attacks in the wild.

What this means for your business

For a small business, a compromised website rarely announces itself. It can quietly redirect visitors, display content you never approved, or damage the trust that brings customers to your door. The window for this particular attack is narrow — in laboratory conditions the staging directory normally remained available for only seconds — but attackers are getting around that by polling sites repeatedly in an effort to catch the brief upgrade moment. The practical steps below come from Wordfence’s advisory on the release.

First, check your version today. In your WordPress dashboard, go to Dashboard > Updates and confirm your site is running WordPress 7.1.4 or the corresponding patched release for its branch. Do not assume an automatic update completed — verify it.

Second, do not rely on a firewall instead of patching. A firewall rule reduces exposure while you update, but installing the fixed Core version removes the vulnerable behaviour. If you use Wordfence, check that the firewall is enabled and optimised with Extended Protection, which matters here because the malicious request goes directly to a PHP file without loading WordPress first.

Third, if your site was unpatched while this flaw was public, look for signs of trouble: unexpected requests to PHP files beneath wp-content/upgrade, unfamiliar administrator accounts, plugins you did not install, or PHP files you did not place there. Then run a security scan after updating, which can identify unexpected Core changes and malicious files.

Fourth, treat updates as routine maintenance, not a one-off chore. The gap between a fix being published and attackers probing for unpatched sites is now measured in minutes, not weeks, and this flaw shows that even the update process itself needs to be kept current.

A note from Zain Ali, founder of Zee Developers

“When WordPress released this fix a week ago, the advice was to check your update had actually gone through. Now that CISA has confirmed attackers are actively exploiting it, that check is no longer something to get round to — it is something to do today. It takes a couple of minutes to confirm your version in the dashboard, and that one check is the difference between a patched site and one that attackers are still polling for. If you are unsure whether your site is up to date, get it checked now rather than waiting for a problem to show itself.”

If you are unsure whether your website is up to date, or you would like help checking it over, get in touch with Zee Developers and we will be happy to help.