CISA flags an actively exploited WordPress flaw: what small business sites should do this week
A bug in the way WordPress updates itself is being used in real attacks. The fix is already out. Here is how to make sure your site has it.
On November 3, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added a WordPress core vulnerability, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog. Being added there means attackers are already using the flaw, not just talking about it. Federal civilian agencies have until November 6 to patch. Nobody sets a deadline for a bakery, a dental office or a three-person law firm, but the risk to their sites is the same.
The flaw sits in WordPress itself, not in a plugin, so you can't fix it by removing a plugin. It affects every version from 4.7 through 7.1.3. The fix shipped on October 28 in WordPress 7.1.4, along with patched releases for each older branch back to 4.7. If your site updates itself, it is probably already safe. If you're not sure, check today. The rest of this post explains how.
For most of our readers this is a ten-minute job. Some businesses have built more onto WordPress over the years: booking forms, member areas, a store tied to the till, plugins nobody remembers installing. For them, an incident like this is a good moment to ask whether the site still fits the business, or whether it's time to bring in a custom web development partner such as YuSMP Group and build something that is easier to keep patched.
What happened?
When WordPress updates itself, it first unpacks the new version into a temporary staging folder inside wp-content/upgrade/. On many servers that folder can be opened from the web, and its name is easy to guess. According to CISA's listing, this allows an unauthenticated attacker to run code on the server during the upgrade window. In plain terms, someone who requests the half-installed copy at the right moment can take over the site. No password is needed.
WordPress 7.1.4 closes the gap by giving the staging folder a random name and blocking the installer script from running there. The release also fixes a batch of smaller problems, including stored cross-site scripting issues. The WordPress team's advice is short: "it is recommended that you update your sites immediately."
How fast are attackers moving?
Very fast. The security firm Wordfence reported that the first attack hit its new firewall rule nine minutes after the rule went live. In the first 21 hours it logged more than 18,500 requests aimed at staged installer paths, Security Affairs reported. Bots don't choose targets by size. They scan every WordPress site they can find, and a small shop site is just as easy to reach as a large one.
What should a small business do this week?
- Confirm the version. 7.1.4 or a patched older release is safe. Anything else needs an update today.
- Take a backup first, then update. Use your host's backup or a backup plugin, and check that the backup includes the database.
- Check who has admin access. Remove old staff, past freelancers and accounts nobody recognises.
- Look for strange files. If you or your host can browse the server, check
wp-content/upgrade/for leftover folders. A file you didn't expect there is a reason to call your host. - Ask your host one question: who applies WordPress security releases, and how quickly? Our small business hosting checklist lists the other questions worth asking.
If you find anything odd, such as new admin users, pages you didn't write or redirects to unknown sites, don't just update and move on. Restore from a clean backup taken before October 28 and change every password. Wordfence keeps a technical write-up for whoever looks after your server.
What does this mean for your website in the long run?
Automatic background updates did their job here. Sites that left them on got the fix without anyone lifting a finger. The sites at risk are the ones where updates were switched off because a plugin once broke, or where nobody has logged in for a year. That is a maintenance problem, not a WordPress problem, and it is the main reason we run managed hosting with security updates applied for clients.
If your site has grown into something your business depends on every day, such as online orders, bookings or customer accounts, it deserves the same care as the till. Keep it patched, back it up, and know who you'll call when the next alert comes.
The people who design, host and maintain small business websites at Silicon Data Corp in San Jose. About us
