A severe WordPress flaw now under active attack can hit your site even during the update meant to fix it. Here's what to check today before you click "update."
If your business runs a WordPress website or online shop, there's a new problem that goes beyond the usual "update now" advice. A high-severity vulnerability tracked as CVE-2026-119977 can let an attacker take over your server during the very update that's supposed to fix it. Public proof-of-concept exploit code has been circulating for the last 48 hours, and the US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active attacks.
What's actually going on
The flaw is a race condition in WordPress Core's updater — technically a "time-of-check time-of-use" (TOCTOU) issue — affecting every WordPress version from 4.7.0 through 7.1.3. It was fixed in version 7.1.4. According to the researchers who found it, an unauthenticated attacker can time an attack to the exact moment a core update is unpacking files and run malicious code on the server, no login required (source).
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on 3 November 2026, confirming the flaw is being actively exploited in the wild and urging all organisations, including the private sector, to prioritise patching immediately (source).
The twist: updating isn't fully safe either
Here's the part that makes this flaw unusual. Even if you apply the official fix, your site can still be hit one more time during the installation process. That's because the update package that installs the fix is itself unpacked using the site's old, still-vulnerable updater code. An attacker who strikes at precisely the right moment during that window can still execute code on your server (source).
In other words, this has moved past the usual "patch this" advice. You need to both update and lock down the upgrade process itself.
What to do today
- Block web access to the wp-content/upgrade folder at the server level before you start any update. WordPress never needs to serve that folder over HTTP, so blocking it closes the attack window without breaking anything. Do this via your web server config (Apache .htaccess or Nginx rule) before you click update, not after.
- Update to WordPress 7.1.4 or later as soon as the upgrade folder is locked down.
- Check your WordPress version right now. If your site is still running anything between 2.7 and 4.6, there is no patch coming — those versions are no longer supported. The only fix is a full upgrade to a supported release, not a simple update (source).
- Check your plugins and themes too — an unauthenticated remote code execution flaw like this is exactly the kind of thing automated scanning bots look for within hours of a public proof-of-concept appearing.
- Review server logs for unusual activity around your wp-content/upgrade directory in the past week, especially if you updated WordPress recently without first blocking that folder.
Why this matters for Swiss SMEs specifically
WordPress powers a large share of small business websites and online shops in Switzerland, often set up once and left largely unmanaged. That's exactly the profile attackers are scanning for right now: unauthenticated, server-level access, no need to guess a password. If your website handles customer orders, bookings, or any payment data, an unpatched or improperly patched WordPress install is a direct line into your business.
This is also a reminder that vulnerability management isn't a one-time task. New flaws like CVE-2026-119977 appear regularly, and the gap between disclosure and active exploitation keeps shrinking — in this case, just days. Businesses that rely on someone remembering to check for updates are already behind.
We keep watching this space closely and will keep reporting on the vulnerabilities that actually matter for Swiss businesses — not every CVE, but the ones putting real websites and servers at risk right now. If you want this kind of monitoring, patching, and server hardening handled for you rather than squeezed in between everything else, Flitz.ai and The Mejlerö Company support businesses in Obwalden, Nidwalden, Lucerne, and Zurich with remote and on-site IT support, including security basics like endpoint protection and two-factor authentication. A free network analysis and a free one-hour consultation are a good starting point if you're not sure where your own exposure stands.
Switzerland.