There's a WordPress remote code execution vulnerability out in the wild: CVE-2026-119977. It affects every WordPress version from 4.7 through 7.1.3, and attackers started probing for it the day the patch came out. Patch time again.
Please update your WordPress sites ASAP. Go to Dashboard > Updates and install 7.1.4, or the fixed release for your branch (7.0.8, 6.9.11, 6.8.12, etc.). Sites on WordPress 4.6 or older get no fix and need a full upgrade.
We are actively working to block this attack on our servers until everyone upgrades, but blocking is a stopgap. Updating is the fix.
Technical details, server block rules and how to check a site for compromise are on our blog: CVE-2026-119977: WordPress core updater RCE hits 4.7 through 7.1.3.
If you need assistance, please contact support.
Sunday, November 1, 2026
