WordPress 7.1.4 security update: the flaw attackers are already targeting

The WordPress 7.1.4 security update, released on 28 October 2026, fixes a flaw that attackers are already trying to use. Tracked as CVE-2026-119977, it lets someone with no login run code on your server in the few seconds while WordPress installs a core update. On 3 November the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue, and NHS England Digital's cyber alert says further attacks are likely. If your business website runs on WordPress, check today that it is on 7.1.4 or the patched release for your branch. There is also a second, separate bug in a compression tool called Brotli that only your hosting company can fix.

What is the WordPress 7.1.4 security update?

WordPress 7.1.4 is a security release. The official WordPress 7.1.4 announcement and the 7.1.4 release notes list more than a dozen fixes, mostly cross-site scripting issues that need a logged-in user to exploit. The serious one is different.

Key facts:

• The flaw: a race condition in the WordPress core updater, reported by Umut Bayram of Picus Security.
• Affected versions: WordPress 4.7 up to and including 7.1.3.
• Severity: rated 8.1 out of 10 (CVSS 3.1), according to NHS England Digital.
• Fixed in: WordPress 7.1.4, with matching security releases for older branches back to 4.7.
• Exploited: yes. CISA listed it on 3 November 2026 and gave US federal agencies until 6 November to patch.

How does the attack work?

During a full core update, WordPress unpacks the new version into a temporary folder inside wp-content/upgrade before copying it into place. On many servers that folder can be reached from the web, and its name is predictable. If an attacker reaches the WordPress installer inside it before the copy is tidied away, they can set up their own administrator account and run code on your server. In plain terms, they could take over the whole site.

Picus Security's technical write-up explains that the attacker can even swap in their own configuration file, pointing your site at a database they control.

Is anyone actually being attacked?

Yes, attackers are trying. Wordfence reports that probing began on the same day the fix was released. Its firewall had blocked more than 240,000 attempts, with the peak on 30 October when it stopped over 74,000 in a single day.

Keep this in proportion. Wordfence also says that blocked attempts are not the same as hacked sites, and that pulling off the attack is difficult in practice because the window only lasts as long as an update. Most of the traffic is automated bots repeatedly checking the same folder in the hope of catching a site mid-update.

Why the update itself is the last risky moment

There is a catch. The update that installs 7.1.4 is run by the old, unpatched updater already on your site. The Hacker News reports that on sites running WordPress 5.9 or later, the temporary folder name can be guessed one final time during that update.

That does not mean you should wait. Wordfence's advice is to update as soon as possible, because once a site is on a patched version, future updates are no longer exposed. The sensible extra step is to block web access to the wp-content/upgrade folder first. That folder is only used behind the scenes, so blocking it does not stop updates working.

The Brotli bug your host has to fix

The second issue is not in WordPress at all. Brotli is a compression library made by Google that sits on many web servers. A critical flaw, CVE-2026-111497, was fixed by the Brotli project in versions 1.0.10, 1.1.1 and 1.2.1 on 21 October 2026, and it scores 9.2 out of 10 on the newer CVSS 4.0 scale.

Why it matters for WordPress sites:

• WordPress can ask your server to fetch data from other websites, and the server may use Brotli to unpack the reply.
• Wordfence's Brotli explainer shows a public proof of concept that reaches the flaw through the old XML-RPC pingback feature.
• Updating WordPress, a plugin or a theme does not fix it. Your host must install the patched library and restart the services that use it.
• Wordfence says the public reports it had reviewed up to 2 November did not show a confirmed real-world break-in.

Linux vendors such as Ubuntu have published patched packages, so a reputable host should already have this in hand. It is still worth asking.

What this means for your business

For most small firms, the website is the shop window, the booking desk and the place Google and AI tools check before sending people to you. A hacked site can be defaced, used to send spam or loaded with junk pages, and it can take months to recover in search. We have seen exactly that pattern, which we wrote about in only your homepage showing on Google.

Who needs to do what:

• If your developer or host manages WordPress for you: send them a short email asking them to confirm 7.1.4 is installed, the upgrade folder is blocked, and Brotli is patched.
• If you update the site yourself: log in, go to Dashboard, then Updates, and check the version number.
• If nobody has touched the site in a year or more: treat this as the prompt for a proper check-up, because plugins and themes will need attention too.

A five-step check for this week

1. Check your version. In WordPress, go to Dashboard, then Updates. You want 7.1.4, or the latest security release for your branch if you are on an older version.
2. Block the upgrade folder before updating. Ask your developer or host to stop the web server serving wp-content/upgrade. Picus advises against putting a protective file inside that folder, because the old updater wipes it.
3. Update straight away. Do not postpone it out of caution. The risk only exists while the update runs.
4. Ask your host about Brotli. One question does it: has the Brotli library on my server been patched for CVE-2026-111497 and the services restarted?
5. Look for warning signs. New administrator accounts you did not create, unfamiliar plugins or odd pages in Google are all worth reporting to whoever looks after the site.

A good security plugin adds a useful extra layer. Our guide to the best security plugins for WordPress compares the main options, and our post on the WordPress 7.1.1 security update explains why these releases keep coming.

FAQ

Is WordPress 7.1.4 safe to install?

Yes. WordPress recommends installing it immediately. The only risk is during the update itself, so block web access to the wp-content/upgrade folder first if you can, then update.

Does automatic updating protect my site?

Sites with automatic background updates switched on, which is the default for security releases, should already be on a patched version, according to Wordfence. It is still worth checking, because some sites have automatic updates turned off or failing quietly.

What is CVE-2026-119977?

It is the reference number for the WordPress core flaw fixed in 7.1.4. It affects versions 4.7 to 7.1.3 and can let an attacker with no account run code on the server during a full core update.

Will updating WordPress fix the Brotli vulnerability?

No. Brotli is a server library, not part of WordPress. Your hosting company or server administrator has to install the patched version and restart the affected services.

Not sure who is keeping your website patched?

You are busy running your business, and keeping up with security notices is not where most owners want to spend their week. If this has raised questions about your own site, our digital consultancy can give you an honest view of your hosting and plugins, and our website design and development packages include optional hosting and a managed layer so updates are not left to chance.

The easiest first step is our free website offer. We will look at how your site is built and hosted and tell you plainly what needs fixing.