WordPress flaw can still be abused during the fix install
Nov 6, 2026 · Summarized by Fundy Tech from 2 sources
WordPress fixed an actively exploited flaw, but some sites can still be attacked while the update is installing. Site owners should block web access to wp-content/upgrade before updating.
Key points
- CVE-2026-119977 affects WordPress 4.7 through 7.1.3.
- Attackers may run code during the update window.
- WordPress 7.1.4 and older-branch fixes were released last week.
Why it matters
If you run a WordPress site, updating without extra protection can still leave a short opening for attackers. That matters for small businesses that depend on their site for sales, bookings or customer contact. Blocking web access to the upgrade folder reduces that risk without breaking updates.
Who’s affected: WordPress sites updating to the fixed release
What to do
- Patch WordPress now.
- Block web access to wp-content/upgrade.
- Use a manual update outside the web server if needed.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.