WordPress 7.1.4 Flaw: What Indian Site Owners Must Do

In short: WordPress 7.1.4, released on 28 October 2026, fixes 22 security issues, including a race condition during core updates that could allow remote code execution (CVE-2026-119977). On 3 November 2026, CISA added this flaw to its list of actively exploited vulnerabilities. Every WordPress site owner should confirm the update has installed and block web access to the wp-content/upgrade folder.

What Happened

On 28 October 2026, WordPress released version 7.1.4 as a security release fixing 22 vulnerabilities. The most serious, according to the release notes, is "a race condition during core updates that could lead to remote code execution", reported by researcher Umut Bayram. Fixes were also provided for older branches back to version 4.7.

The flaw was given the identifier CVE-2026-119977. Wordfence, which assigned the CVE, rates it 8.1 (High), while WordPress itself rates it Low because the attack is hard to time. On 3 November 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation, as reported by several security outlets. Reports so far describe large numbers of exploitation attempts. We have not seen a published count of confirmed site compromises.

How the Flaw Works

According to analyses by Wordfence and Patchstack summarised in security reports, during a full core update WordPress unpacks the new files into a predictable folder inside wp-content/upgrade. On many servers this folder can be reached from the web. An attacker who requests the installer file in that folder at exactly the right moment may be able to run code on the site.

The window is short, often only seconds, but automated tools can keep polling sites to catch it. Because the malicious request goes straight to a PHP file, a security plugin running inside WordPress may not see it. The fix adds a random name to the staging folder and other safeguards.

The same release also fixes several cross-site scripting issues, an information disclosure issue in the Customizer and other smaller bugs, according to the WordPress release notes.

Who Is Affected

• Sites running WordPress 7.1.0 to 7.1.3, and older branches that have not received their fixed minor release.
• Sites with automatic updates turned off, or managed by agencies that update only occasionally.
• Very old installs on version 4.6 or earlier, which receive no fix at all.

Many Indian businesses, schools and institutions run their websites on WordPress and rarely look at them after launch. Those are the sites most likely to be left behind.

What It Means for Indian Businesses

A hacked website can serve malware to customers, steal form data such as enquiries, and damage search rankings. If personal data is exposed, the Digital Personal Data Protection Act may also be relevant, and CERT-In's 2022 directions require covered entities to report specified incidents within six hours. Check with your adviser on what applies to you. The practical point is simple: update now and verify, rather than assuming auto-update worked.

What to Do Now

1. Check your WordPress version. Log in and open Dashboard, then Updates. Confirm you are on 7.1.4 or the fixed release for your branch.
2. Block web access to wp-content/upgrade. Ask your developer or host to deny web requests to this folder at the server level, ideally before the next update runs.
3. Update every site you own. Include microsites, campaign pages and old sites that may be forgotten.
4. Review users and files. Look for new administrator accounts, unknown plugins or unfamiliar PHP files, especially around update times.
5. Check server logs. Search for requests to PHP files under wp-content/upgrade and keep the logs safely in case they are needed.
6. Add server-level protection. A web application firewall at the server or network edge adds a layer that a plugin alone cannot.

The same release also updated root certificates after the eMudhra certificate revocation, another reason to make sure it is installed.

Frequently Asked Questions

Is my site safe if automatic updates are on?

Most sites with background updates should receive 7.1.4 automatically, but security researchers advise checking the version yourself rather than assuming the update completed.

My site is on an old WordPress version. What should I do?

Fixes were released for branches back to 4.7. Sites on 4.6 or earlier get no fix and should be upgraded to a supported version as soon as possible.

Do I need to report this to CERT-In?

Installing the update is not reportable. If you find signs that your site was compromised, check CERT-In's reporting requirements with your adviser, since covered entities must report specified incidents within six hours.

How Affix Center Can Help

Affix Center manages and secures business websites for organisations in Mumbai and across India. Our web development team can update and harden your WordPress sites, and our cybersecurity team can check for signs of compromise. See our website maintenance services guide for ongoing care.

For a quick check of your WordPress sites, contact us.