If your business website runs on WordPress, this is the week to check it. The WordPress 7.1.4 security update, released on October 28, 2026, closes a core flaw that the US Cybersecurity and Infrastructure Security Agency (CISA) has now confirmed is being exploited in the wild. Attack traffic started within minutes of the fix going public, so an unpatched site is a real target, not a theoretical one.
Below we explain what the flaw is, who is affected, and the exact steps to confirm your site is safe, whether you run an online store in Miami, a clinic in Dubai or a services firm in Lahore.
What happened: the WordPress 7.1.4 security update in brief
On October 28, 2026 the WordPress project shipped version 7.1.4 and told site owners to update immediately. The headline fix is for a weakness in the WordPress upgrade process itself that could lead to remote code execution while an upgrade is running. The flaw is tracked as CVE-2026-119977 and was credited to researcher Umut Bayram.
Key dates so far:
- October 28: WordPress 7.1.4 released. Security firm Wordfence deployed a firewall rule the same evening and saw its first matching attack about nine minutes later.
- First 21 hours: Wordfence reported more than 18,500 blocked requests aimed at the vulnerable upgrade paths.
- November 3: CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
- November 6: deadline for US federal civilian agencies to fix it.
Release 7.1.4 also fixed around 20 smaller issues, including several stored cross-site scripting (XSS) bugs.
How the WordPress vulnerability works
When WordPress updates its own core files, it briefly unpacks the new package into a staging folder under wp-content/upgrade/. According to the security researchers who analysed the bug, those staging files sit at predictable, web-reachable paths for a short time. An attacker who does not need to log in can race that window and get code running on your server. It is a classic time-of-check/time-of-use race condition.
Wordfence rates it 8.1 (High) on the CVSS scale, while the official WordPress advisory rates it lower because the attack depends on timing. CISA’s decision to list it as actively exploited is the signal that matters most for business owners.
Which WordPress versions are affected?
Researchers list WordPress 4.7 through 7.1.3 as vulnerable. The fix is in 7.1.4, and the WordPress team said security backports for older branches would ship as they became ready, so if you are on an older branch, check the official releases page for your fixed version. Sites on 4.6 or older have no fix and need a full upgrade.
Only self-hosted WordPress (the free software from WordPress.org) is in scope. If an agency or host manages your site, ask them to confirm the version in writing.
Why this WordPress security update matters for businesses in the USA and UAE
WordPress powers a huge share of small and mid-sized business websites, which is why attackers automate scans for every new core flaw. A compromised site can mean:
- Lost leads and sales if your site is defaced, redirected to spam or taken offline.
- Google penalties: browsers and search engines warn visitors away from hacked sites, and rankings you built over years can drop quickly.
- Data exposure: contact forms, WooCommerce orders and customer accounts can leak, which brings legal duties under US state breach laws and the UAE’s Personal Data Protection Law.
- Payment and ad account bans when your domain is flagged for malware.
In short, a five-minute update protects your revenue and your search visibility.
How to check your WordPress version and apply the fix
- Check your version. In the dashboard go to Dashboard > Updates. Developers can run
wp core versionwith WP-CLI. - Update now. Click Update to version 7.1.4 (or the fixed release for your branch), or run
wp core update. Take a backup first if you do not have a recent one. - Do not assume auto-updates worked. Sites with automatic background updates should receive the fix on their own, but security analysts advise confirming the version rather than assuming the update finished.
- Verify core files. Run
wp core verify-checksumsto spot modified core files. - Block the upgrade folder. Some researchers suggest denying web access to
/wp-content/upgrade/at the server level as an extra layer. A firewall rule helps, but it is not a substitute for updating.
Signs your WordPress site was hacked through this flaw
Security analysts recommend checking:
- Web server access logs for successful (HTTP 200) requests to PHP files such as
setup-config.phporinstall.phpunderwp-content/upgrade/. Blocked (403/404) requests are just scanning. - Unfamiliar administrator accounts, plugins you did not install, or PHP files you did not place.
- Unexpected changes to
wp-config.php, especially a database host you do not recognise.
If you find signs of compromise, take the site offline, restore from a clean backup taken before the exposure, update, and rotate all database and admin passwords. Our guide My WordPress Site Was Hacked: What to Do in the First Hour walks through the full recovery process.
Practical next steps for business owners
- Ask whoever manages your website to confirm today that it runs 7.1.4 or a patched branch release.
- Turn on automatic minor updates and keep plugins and themes current.
- Make sure you have daily off-site backups and know how to restore them.
- Add a web application firewall and uptime and malware monitoring.
- Book a periodic security review, especially if you take payments or store customer data.
TASCO IT Solutions offers cybersecurity services including WordPress hardening, malware clean-up and monitoring, and our web development team can take over maintenance so updates like this are handled the same day. If your rankings dropped after a hack, our SEO team can help you recover.
Frequently asked questions
Is WordPress 7.1.4 safe to install?
Yes. WordPress 7.1.4 is the official security release and the WordPress team recommends updating immediately. Back up your site first, then update from Dashboard > Updates.
How do I know if my WordPress site was affected by CVE-2026-119977?
Check your server access logs for successful requests to PHP files inside wp-content/upgrade/, look for unknown admin users or files, and run wp core verify-checksums. If anything looks wrong, restore a clean backup and change all passwords.
Do WordPress automatic updates fix this vulnerability?
Sites that support automatic background updates should receive the fix on their own, but you should still log in and confirm your site shows version 7.1.4 or the patched release for your branch.
Need help securing your WordPress site?
Not sure if your site is patched? Our team in Miami, Dubai and Lahore can check it for you and set up ongoing protection. Message us on WhatsApp at +971 58 661 3940 or email info@tascoit.com.