WordPress sites can be taken over while they update.

What's happening.

When WordPress installs a full core update, it unpacks files into predictable folders that anyone on the internet can reach. For a short window during the update, an attacker can use that to run their own code on the server.

WordPress released 7.1.4 on 28 October 2026. CISA added the flaw to its list of exploited vulnerabilities on 3 November 2026.

What it means for you.

Someone who can run code on your web server can change or delete your site, steal customer data held on it, or use it to attack others. The window is short, but attackers are already using the flaw.

How to fix it.

1. Update to WordPress 7.1.4 now: open the Dashboard, choose Updates, then Update Now.
2. If your site updates itself, check the Dashboard shows 7.1.4.
3. Older versions: WordPress is releasing matching fixes for older branches. NVD lists, for example, 6.0.18, 5.9.20 and 4.7.39. Use the latest release for your branch.
4. Take a full backup before updating, and check the site afterwards.
5. If you cannot rule out an attack in the last few days, ask your host or developer to look for files and admin users you do not recognise.