WordPress 7.1.4 Security Update: Why You Must Patch Now

If your business website runs on WordPress and it is not on version 7.1.4 (or the latest security release of its branch), update it today. WordPress released 7.1.4 on 28 October 2026 as a security release and told site owners to "update your sites immediately" in its official announcement. On 3 November, the US Cybersecurity and Infrastructure Security Agency (CISA) added the WordPress core flaw CVE-2026-119977 to its Known Exploited Vulnerabilities list, according to Canada's Cyber Centre advisory AV26-1117, which lists every WordPress core version "prior to 7.1.4" as affected.

What makes this one unusual is where the weakness sits: in the update process itself. That means the way you update matters, not just whether you do. This guide explains what is going on in plain English, how to check your site, and the safest way to patch.

What happened, in short

CISA only adds a flaw to that catalogue when it has evidence of real-world exploitation. The federal deadline applies to US government agencies, but it is a useful signal for everyone else: this is not a "patch when convenient" issue.

What CVE-2026-119977 actually is

The WordPress release notes describe the main fix as a weakness in the upgrade process that "can lead to remote code execution during the upgrade window". Remote code execution is the worst kind of website bug: an attacker who succeeds can run their own code on your server, which usually means full control of the site.

Security firm Picus Security published a technical breakdown of the flaw. In simple terms:

1. When WordPress updates its core files, it unpacks the new version into a temporary folder inside wp-content/upgrade/.
2. Older versions used a predictable folder name, and on many servers that folder can be reached from the web for a few moments.
3. The unpacked copy includes WordPress's setup script. During that short window, an attacker who requests it at the right moment can abuse it, with the aim of taking over the site's configuration and, from there, running code.

Both Picus and Tech Insider report a CVSS severity score of 8.1 (high). Tech Insider notes that the window lasts only seconds, so attackers repeatedly poll the upgrade path hoping to catch a site mid-update. It also cites Wordfence figures of thousands of blocked attempts per day, while pointing out that these show probing volume, not confirmed hacked sites.

According to Picus, version 7.1.4 fixes this by giving the temporary folder a random name, keeping a guard file in place, and stopping the update from copying over the live configuration file.

The other 11 fixes

The same release patches 11 more security issues, according to the WordPress announcement. Most are stored cross-site scripting (XSS) bugs in places such as blocks, the Customizer, the Interactivity API and privacy data removal requests, plus issues where unpublished Customizer changes could be discovered by visitors who are not logged in. Even if the update flaw never touched your site, these are reason enough to update.

Why the update method matters this time

Here is the catch that most quick news stories miss. Picus points out that the first update from an unpatched version still runs through the old updater code. So clicking "Update Now" on a vulnerable site briefly opens the very window the patch is meant to close. On a quiet small business site the odds of being hit in those seconds are low, but they are not zero while automated scanners are polling for it.

That does not mean you should delay. An unpatched site stays exposed every time it updates anything in core, and it also keeps the 11 other bugs. It means you should close the door first, then update.

How to update WordPress safely: a checklist

Work through these steps, or hand them to your developer or hosting provider.

1. Check your version. In the dashboard, go to Dashboard > Updates, or look at the bottom right of any admin page. If it says 7.1.4 or later, core is patched. If your site is on an older branch (for example 6.x), WordPress says it is backporting the fixes to every branch still receiving security updates, currently back to 4.7, and that these "will ship as they become ready". Check the releases page for your branch.
2. Take a full backup of files and database, and store it off the server.
3. Block web access to the upgrade folder before you update. Picus and Tech Insider both recommend this. On nginx, add a rule such as location ^~ /wp-content/upgrade/ { deny all; }. On Apache, use a Directory rule in the main server configuration. Picus warns against placing a .htaccess file inside wp-content/upgrade/ itself, because the old updater deletes that folder.
4. Update core. If you or your host use WP-CLI, wp core update --minor followed by wp core verify-checksums updates and then checks that core files match the official release. Picus suggests that the most cautious route is a manual update, replacing the core files while leaving wp-config.php and wp-content in place.
5. Update plugins and themes too. Remove any you do not use.
6. Look for signs of trouble. Check your access logs for requests to PHP files under wp-content/upgrade/, review Users for admin accounts you do not recognise, check for unfamiliar plugins, and run a malware scan.
7. Confirm automatic updates are on. WordPress says sites that support automatic background updates will start the 7.1.4 update on their own, but many hosts and older setups have this switched off. Make sure security releases install automatically from now on.

If step 6 turns up anything suspicious, change all admin and hosting passwords, rotate the database password and the security keys in wp-config.php, and restore from a clean backup if needed.

What this means for your business

A hacked site rarely shows a dramatic message. More often it quietly redirects visitors to spam, injects hidden links that damage your Google rankings, or steals form submissions. For a business that depends on its website for enquiries, the cost is lost leads and trust, and cleaning up afterwards takes longer than patching.

This comes only days after another serious web platform flaw, the PHP2Shell vulnerability. The lesson is the same both times: websites need ongoing maintenance, not a one-off build. A simple monthly routine of backups, updates, uptime monitoring and a security scan prevents most of these emergencies. If nobody owns that job for your site today, our hosting and maintenance service covers it, and if your WordPress site has become hard to keep secure, we also build fast, modern websites that are easier to maintain.

Frequently asked questions

Is my WordPress site affected by CVE-2026-119977?

Canada's Cyber Centre lists all WordPress core versions before 7.1.4 as affected. If your site is on 7.1.4 or later, or on a patched security release of an older branch, core is fixed.

Will WordPress update itself to 7.1.4?

WordPress says sites that support automatic background updates will begin updating automatically. Many sites have this disabled by their host or developer, so always check the version number yourself.

Is it safe to click "Update Now"?

Updating is far safer than staying on a vulnerable version. To close the brief risk during the update itself, block web access to wp-content/upgrade/ first, as security researchers recommend, then update and verify the core files.

Do I need to do anything if I use a website builder instead of WordPress?

This specific flaw affects self-hosted WordPress core only. Hosted platforms patch their own systems, but you should still keep any apps, plugins and admin passwords up to date.

The bottom line

WordPress 7.1.4 fixes an update flaw that attackers are actively targeting, plus 11 other security bugs. Back up, block the upgrade folder, update, and check for anything unusual, today rather than this weekend. If you would like us to patch, check and look after your site for you, get in touch with Mistique Designs and we will take it from there.