WordPress 7.1.4 and CVE-2026-119977: the update window is the attack surface

WordPress security news usually starts with a plugin. This one does not.

CVE-2026-119977 is a time-of-check time-of-use (TOCTOU) race condition in the WordPress Core update mechanism. It affects versions 4.7 through 7.1.3 and can allow an unauthenticated attacker to execute PHP code during a full-package Core update. NVD describes the cause as predictable, web-accessible staging paths. A fixed release, WordPress 7.1.4, shipped on October 28, 2026.

On November 3, CISA added the flaw to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation.

What actually happens during an update

When WordPress performs a full Core upgrade, it stages files in temporary directories before moving them into place. Portions of that staging location can be predicted and reached over the web while the update is in progress. If an attacker requests the staged installer during that window, they may be able to run code on the server.

The window can be short, sometimes seconds. That is not reassuring. Automated scanners do not need a large window; they need to send requests continuously and wait for one installation to be mid-update.

Wordfence reported more than 18,500 requests targeting staged setup-config.php paths in the first 21 hours after disclosure. Attackers are actively looking for this exact behavior.

Why SMBs should care

This is a Core bug, not a premium-plugin problem. It affects sites that are otherwise well maintained, and it is especially relevant for:

• Sites with automatic background updates enabled. The update protects the site, but the update window itself is what gets attacked.
• Legacy installations that still receive security updates but are not actively monitored.
• Staging and development copies that run old versions and are reachable from the internet.
• Managed hosting where the customer assumes the provider patched, but nobody verified the version.

The practical question is not only "are we on 7.1.4?" It is "can we prove the update completed, and did anything try to exploit the window while it ran?"

A practical response

1. Update to WordPress 7.1.4 or later. Do it on every environment, not only production.
2. Verify the version from the site itself. A successful auto-update job is not proof. Check the WordPress version in the admin dashboard or with wp core version.
3. Inventory forgotten sites. Old marketing sites, client microsites and staging environments are the usual gap.
4. Review logs for the attack pattern. Search web server and WAF logs for requests to wp-content/upgrade and staged setup-config.php paths around update times.
5. Hunt for post-exploitation signs. Unexpected PHP files, new administrator accounts, unauthorized plugins or themes, changed configuration, and outbound connections from the web server.
6. Treat a WAF as temporary cover. Blocking direct requests to staged PHP files helps, but it does not replace the patch.

If you suspect compromise, isolate the site, preserve logs and take a snapshot before cleaning. Then rotate database credentials, salts and any API keys the site could read.

The lesson beyond WordPress

The vulnerability lives in the update process, which is usually treated as trusted plumbing. That pattern generalizes: package managers, deployment scripts, backup restores and migration tools all create temporary states that are rarely tested as attack surface.

A useful audit question for any web application is: "What is reachable while the system is installing, restoring or migrating?" If the answer is "a temporary directory with executable files", that deserves a control.

Where an audit fits

Izkuna's Exposure Snapshot reviews the external surface, including outdated CMS installations and forgotten environments, in three days at the current launch price of $300. The Web Security Audit — Express adds a five-day review of authentication, updates and server configuration at $600 launch.

Patching is the first step. Evidence that the patch is live, and that nobody used the window, is the second.

Sources

• NVD: CVE-2026-119977
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog, November 3, 2026
• Wordfence: WordPress 7.1.4 security release
• SOC Prime: CVE-2026-119977 analysis

If you need to know whether your site is exposed, start with a free 30-minute diagnostic.