If your business website runs WordPress, the software behind a lot of small business websites, check it this week. "It's on auto-update" isn't the same as checked.
Criminals are already going after a flaw in WordPress itself. Not a plugin, not a theme. The part everyone assumes takes care of itself.
What happened
On October 28, WordPress released version 7.1.4. It's a security release that fixes 22 problems. The most serious one is in the way WordPress updates itself. WordPress says it could let an attacker run their own code on the server.
On November 3, the US government's cyber agency (CISA) added the flaw to its list of weaknesses that criminals are actually using. Canada's cyber agency passed that along too. CISA says the attacker doesn't need to log in.
For your IT person, the tracking number is CVE-2026-119977. That's just a public ID number for the flaw.
What this means in plain English
When WordPress updates itself, it unpacks the new version into a temporary folder on your web server first, then moves it into place. Think of a delivery left on the loading dock for a few seconds before someone carries it inside. During those few seconds, the boxes are sitting where anyone walking by can reach them.
That's the flaw. The temporary install files sit at a predictable web address for a short window. eSecurity Planet reports that security firm Wordfence found the window usually lasted only seconds in testing, so attackers keep checking those addresses over and over, waiting to catch one. If they hit it at the right moment, they can run code on the server that hosts your site.
Running code on your server means they can do pretty much what your web developer can do. Add a hidden admin account. Plant files that send visitors to scam sites. Change your pages.
A firewall plugin inside WordPress won't see this, because the attack goes straight at the temporary files, not through WordPress itself.
Why a small business should care
Your website is often the first thing a customer sees. If it starts sending them to a fake login page or a malware download, that's your name on it.
The awkward part: this flaw lives in the update process. So the site that updates itself every time is also opening that window every time. Auto-updates are still the right call. You just need someone to confirm the update actually finished and nothing odd happened while it ran.
In a lot of small shops nobody really owns the website. Whoever built it moved on, and the admin login lives in someone's inbox. That's how a site sits unchecked for a year.
Who's affected
WordPress sites on older, unpatched versions, from 4.7 up to 7.1.3.
The fix is 7.1.4. Older branches got their own fixed versions too, for example 7.0.8, 6.9.11 and 6.8.12, all the way back to 4.7.39. WordPress says only the newest version is actively supported.
Versions 4.6 and older get no security fixes at all. That's a rebuild conversation.
What to do: everyone
Find out who logs into your website and who your hosting company is. Write both down somewhere other than one person's inbox.
Ask that person to log in, go to Dashboard then Updates, and confirm the version number. It should say 7.1.4, or the fixed version for its branch.
Have them look at the list of users for any administrator account nobody recognizes.
Have them look at the list of plugins for anything nobody remembers adding.
If something looks wrong, don't start deleting things. Call your IT people first.
What to do: if you run the business
Make one person responsible for the website. Give it a name on a list.
Make sure the business, not a former contractor, owns the admin login and the hosting account.
If you pay a hosting company or web shop for "managed WordPress," ask them in writing what version you're on and whether they checked for this.
If someone does find signs of a break-in, keep the logs. eSecurity Planet points out that updating closes the hole, but it doesn't kick out someone who already got in.
Questions to ask your IT provider
What version of WordPress is our site on right now, and when did it last update successfully?
Did you check the web server logs for odd requests to the temporary upgrade folder, including a file called setup-config.php?
Can our hosting block public access to that temporary upgrade folder?
Sources
eSecurity Planet: CISA Confirms Exploitation of WordPress Core Upgrade Flaw
WebHosting.Today: CISA Lists a Fourth WordPress Core Flaw Since July. WordPress Rates This One Low
Contact Nautalex to see how we can help you with keeping your website updated.
