WordPress 7.1.4 Fixes Actively Probed Upgrade-Window RCE

WordPress 7.1.4 patches CVE-2026-119977 (CVSS 8.1), an unauthenticated RCE during core upgrades. Confirm your version and review upgrade-path probes.

WordPress 7.1.4, released on 28 October 2026, fixes an unauthenticated remote code execution weakness in the core upgrade process (CVE-2026-119977, CVSS 3.1 8.1 High). Attackers have been probing sites for the brief upgrade window. If you run WordPress for a company site, shop or marketing site in Hong Kong, confirm you are on 7.1.4 or the matching security backport for your branch today.

What happened

The official WordPress release notes describe a weakness in the upgrade process that can lead to remote code execution during the upgrade window, reported by Umut Bayram. The post does not assign a CVE or CVSS score. Wordfence later tracked the issue as CVE-2026-119977 with a CVSS 3.1 score of 8.1. Tenable lists the same CVE as published on 31 October 2026, with the same score and a description that matches Wordfence.

According to Wordfence and reporting that quotes it, affected WordPress Core versions are 4.7 through 7.1.3. When a site performs a full-package core update, the new files are unpacked into a predictable, often web-accessible staging path under wp-content/upgrade, including installer files. An unauthenticated attacker who requests the staged installer at the right moment can progress to PHP code execution before WordPress cleans up. Lab windows can last only seconds, but attackers poll paths such as staged setup-config.php repeatedly.

Patched current line: WordPress 7.1.4 (also included in 7.2 Beta 3).
Branch backports (examples): 7.0.8, 6.9.11, 6.8.12 … through 4.7.39. WordPress says backports through 4.7 are in progress or shipping as ready; only the latest major is actively supported.
Not a plugin issue: this is WordPress Core. Separately, keep PHP patched — see our earlier note on PHP2Shell, which is a different runtime issue.

Active probing, not confirmed mass compromise

Wordfence says it deployed a firewall rule for paid customers hours after the release and saw a matching request about nine minutes later. It reported more than 18,500 requests aimed at staged installer paths in the first 21 hours. On 30 October, The Hacker News, citing Wordfence, reported 62,969 blocked attempts in 24 hours. At that time THN noted no CVE identifier; CVE-2026-119977 appears in public CVE listings around 31 October.

Neither Wordfence nor THN has stated confirmed successful compromises tied to this flaw. Treat the numbers as blocked or observed probing. Wordfence also notes that a request aimed straight at a staged PHP file may bypass a plugin firewall unless Extended Protection (or equivalent early loading) is enabled, and that the free Wordfence rule is delayed until 27 November 2026. A web application firewall (WAF) is a stopgap, not a substitute for the core patch.

Why it matters to Hong Kong SMEs

Many Hong Kong SMEs, agencies and shops run WordPress on shared hosting or a small VPS. Auto-updates are often on, so the upgrade window can open without anyone watching the dashboard. A successful race could mean webshells, new admin accounts or rogue plugins — and from there, customer data, payment integrations or email compromise. HKCERT has also published a bulletin, "WordPress Multiple Vulnerabilities" (2 November 2026, rated Medium Risk), covering WordPress versions before 7.1.4 and the matching branch backports. Whatever the rating, patch promptly.

Good patch management and website monitoring help you catch version drift and odd traffic early.

What to do now

Update immediately. In Dashboard → Updates, confirm 7.1.4 or your branch’s fixed release (for example 7.0.8 or the listed 6.x / 5.x / 4.x backports). If auto-update did not finish, click Update Now.
Until patched, reduce exposure at the web server. Where you can, deny HTTP access (or PHP execution) to wp-content/upgrade. This mitigates the race; it does not replace upgrading.
Review logs. Look for requests to staged setup-config.php or unexpected PHP under wp-content/upgrade, especially around recent core updates.
Check for persistence. Unexpected admin accounts, plugins you did not install, or PHP files you did not place warrant a malware scan and further investigation.
Keep auto-updates on where appropriate after you are patched, and keep hosting PHP current.
Treat WAF rules as temporary. Paid Wordfence users may already have a rule; free-tier delay and Extended Protection limits apply. Patching remains essential.

Our cybersecurity and compliance team can help assess exposure, and managed support can take on ongoing WordPress and server patching.

Frequently asked questions

Is this the same as PHP2Shell?

No. PHP2Shell concerns critical flaws in the PHP runtime. CVE-2026-119977 is a WordPress Core upgrade-window race. You should address both.

We use managed WordPress hosting. Are we safe?

Ask the host whether every site is on 7.1.4 or the correct backport, and whether they block web access to wp-content/upgrade. Do not assume.

Were Hong Kong sites compromised?

We have not seen public confirmation of successful exploitation, in Hong Kong or elsewhere. Sources report active probing and blocked attempts.

Does a firewall alone protect us?

No. Patch first. A firewall may reduce risk during the delay, especially with early-loading modes, but it is not a permanent fix.