The WordPress team closed a critical vulnerability in the core with version 7.1.4, released on October 28. The issue, registered as CVE-2026-119977, affects all WordPress installations from version 4.7 through 7.1.3. Security firm Wordfence announced that it blocked 43,560 attack attempts targeting this vulnerability in the past 24 hours.
The vulnerability targets the exact update moment
The root of the problem lies in the temporary folders WordPress uses during a full-package core update. The system places downloaded files in predictable, web-accessible paths. While the update window is open, an attacker can drop their own PHP file into that path and execute it. They do not need to log in to the dashboard for this.
Wordfence classifies the vulnerability as a TOCTOU flaw: the gap between the moment a file is placed and the moment it is checked is exploited. The CVSS score is 8.1. Because the attack must coincide with the update moment, complexity is high, but the number of attempts is quite large. This shows that attackers are scanning site by site and trying their luck.
Which versions are affected
The vulnerability is present in all versions from 4.7.0 through 7.1.3. The fix is in version 7.1.4. WordPress supports only the latest version, but it also backports patches to older branches: 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, and 6.0.18 are among them. Patches have also been prepared for older branches, going down to 4.7.39.
What else was fixed in 7.1.4
This release does not close just a single vulnerability. The announcement lists fixes under 13 headings. Stored XSS via content prepared with block markup, multiple stored XSS issues and one stored denial-of-service issue in the Interactivity API, XSS in Customizer selective refresh, XSS in the Categories block, XSS via crafted user inputs, XSS in the Playlist and image blocks, XSS in comment pagination blocks, and XSS in privacy data deletion requests are among them.
In addition, unpublished Customizer changesets can no longer be viewed by unauthorized users. Privileged users who lack permission to edit a post attached to a note also cannot read that note. Root certificates in the package were also updated due to the eMudhra certificate revocation.
This core vulnerability was reported by Umut Bayram from Picus Security. The WordPress security team also added the fix to version 7.2 Beta 3.
What site owners should do
It is enough to go to the Updates screen in the dashboard and use the Update Now button. On sites with automatic background updates enabled, the new version has often installed itself automatically. Those still on the 7.0 branch should move to version 7.0.8. It is worth checking the version number after updating, because every version below 7.1.4 remains vulnerable.
7.1.4 is a short-cycle security release. It does not introduce new features, so there is no technical reason to delay the update. The stable 7.2 release is coming on December 8.
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.