Evening edition · Thursday, 5 November 2026
Patched on 28 October, exploited by 3 November: WordPress and the week between the fix and the update
A flaw in WordPress's own update process is being used in attacks. The repair has existed for a week; the gap is the people who have not yet pressed the button.
The most dangerous moment for a website is not the day a flaw is found. It is the week after the fix is published, when the repair is public and the attackers can read it too. WordPress, the software behind a great many small websites, is in that week now.
The WordPress security team released version 7.1.4 on 28 October to close a weakness in its upgrade process “which can lead to remote code execution during the upgrade window”, and asked owners to update immediately1. The flaw, CVE-2026-119977, is a race condition: during a full core upgrade, predictable staging paths on the server can be reached from the web, and a remote attacker without an account can, in a hard-to-pull-off attack, run code1.
On Tuesday the US Cybersecurity and Infrastructure Security Agency confirmed that attackers are using it and added it to its catalogue of known exploited vulnerabilities1. Federal civilian agencies have until Friday to secure their systems; CISA urged private defenders to treat it as a priority too1. The security firm Wordfence said over the weekend that it had blocked 13,095 attacks on this flaw in 24 hours1. This is not a first: in July a separate chain of WordPress flaws was exploited within days of public exploit code appearing1.
Nothing about this calls for a new tool. It calls for an inventory. Many WordPress sites belong to marketing teams, associations or agencies rather than to anyone who thinks of themselves as an IT department2. The useful questions are dull ones: which sites carry your name, who holds the admin login, and what version they show today. If a site is on 7.1.4 or later, the known door is shut. If nobody can say, that is the finding.
If you run a site yourself, update, then look for administrator accounts or files you do not recognise2. If someone else runs it for you, ask them for the version number and the date it was installed. A short e-mail with a specific question gets a better answer than a general worry.
What to watch
- Friday 6 November: the deadline CISA has set for US federal civilian agencies to secure their WordPress systems1.
- Whether the agency or volunteer who looks after your club, practice or shop website confirms the update in writing.
A patch is a promise; the update is the keeping of it.
Sources
- CISA flags WordPress RCE flaw as actively exploited in attacks — BleepingComputer, 04 Nov 2026, 13:11 CET.
- Tech news, 5 November 2026: voters reject data centres, WordPress flaw — asksumanta.com, 05 Nov 2026, 05:55 CET.
Every figure in this piece traces to a source above or to the desk’s own arithmetic on those sources, marked as such. Quotations are short and attributed. Spot an error? Write to the desk; corrections are logged on the method page.
Commentary for information only. Not investment, legal, tax, medical or political advice. Not an offer or solicitation. Analysis may be incomplete or wrong. Charts show published public data, not a trading feed; binding numbers live with the institutions that publish them.