WordPress CVE-2026-119977 Exploited: Update to 7.1.4

For the second time in five weeks, a flaw in WordPress itself is being exploited: this one sits in the update process, and it affects every version from 4.7 to 7.1.3. The NCSC also published its yearly figures on the attacks it handled, Ivanti shipped a second fix for the VPN flaws we covered in October, and the ICO fined a solar firm that bought call lists without checking them.

WordPress: a flaw in the update process is being exploited

On 28 October WordPress released 7.1.4, a security release that fixes a dozen security issues. The serious one, now tracked as CVE-2026-119977, is a weakness in how WordPress installs a full update. It unpacks the new files into a folder under wp-content/upgrade with a name anyone can predict, and that copy includes the WordPress installer. An attacker with no login who hits that folder in the few seconds while the update is unpacking can take over the site and run code on the server. Wordfence scores it 8.1 out of 10 and lists versions 4.7 to 7.1.3 as affected.

Attackers moved quickly. Wordfence said it had blocked 62,969 attempts in 24 hours, with some sources polling the same small group of sites for about 14.5 hours to catch an update in progress, as reported by The Hacker News on 30 October. On 3 November CISA, the US cyber agency, added the flaw to its catalogue of exploited vulnerabilities and flagged it for forensic triage, meaning agencies should look for signs of a break-in as well as update.

There is a catch in the fix. Research by Xint, reported by Cyber Kendra on 4 November, found that because the old code on the server does the unpacking, a manual update from an unpatched release up to 7.0.7 straight to 7.1.4 can still be exposed during that one update. Sites that take automatic security updates within their branch get a smaller package without the installer. WordPress has backported the fix to every branch back to 4.7, and only the latest version is actively supported.

What to do: check every WordPress site you run is on 7.1.4 or the security release for its branch, leave automatic security updates switched on, and ask whoever hosts or builds the site to look for unfamiliar administrator accounts, plugins or PHP files under wp-content/upgrade. If the site holds customer data, a takeover is a reportable breach; our 72-hour breach deadline calculator works out the date, and our patch deadline calculator covers the Cyber Essentials 14-day rule. Sources: WordPress 7.1.4 release notes and the CISA catalogue.

NCSC: 1,831 attack reports in a year, most through familiar weaknesses

On 3 November the NCSC published its Annual Review 2026, which it is calling the State of the Cyber Nation, covering 1 September 2025 to 31 August 2026. Its incident team received 1,831 reports of cyber attacks on UK organisations. After triage, 337 needed the team’s support and 80 were classed as nationally significant. Its Early Warning service also told 8,500 organisations about signs that their systems might have been compromised.

The review’s main finding is that most successful attacks still come through known flaws in internet-facing systems, stolen passwords and social engineering, often where a patch existed but had not gone in. It warns that AI-powered malware is “highly likely” to be used in a ransomware attack on UK critical infrastructure by 2028. NCSC chief executive Richard Horne said organisations should treat Cyber Essentials as “the starting point for cyber security, not the end goal”. For a small firm the practical reading is the same as this week’s WordPress story: patch what faces the internet, and use passkeys or multi-factor sign-in so a stolen password is not enough. Our explainer on Cyber Essentials certification covers what the scheme checks. Read the NCSC announcement and the incident figures.

Ivanti VPN: if you patched in October, patch again

In mid-October we reported that Ivanti Connect Secure, a business VPN, had been attacked before a fix existed. On 29 October Ivanti added two more flaws to the same advisory, CVE-2026-111357 and CVE-2026-118527, which attackers had chained with the first one to get root access to an appliance that was fully patched at the time. CISA added both to its exploited list on 30 October.

The important detail is that the October fixes, 25.1.1.2 and 22.8R2.5, do not cover the two new flaws. The fixed releases are 25.1.1.3 and 22.8R2.6. Volexity, which found the attacks, saw the attackers steal credentials and look up Windows LAPS passwords and BitLocker recovery keys, so an appliance that was exposed should be checked, not just updated. If an IT provider runs your VPN, ask which release it is on today. Our page on managed cyber security services covers what to expect from a provider. Sources: Rapid7’s analysis and SecurityWeek.

ICO fines a solar firm £105,000 for bought-in call lists

On 4 November the ICO fined Bluon Energy Ltd, a London solar panel company, £105,000 for making 194,379 unsolicited marketing calls between April 2024 and April 2025 to people registered with the Telephone Preference Service. The ICO found it bought leads from third-party data suppliers without checking that people had agreed to be called, and traded under at least three names. The ICO also said complaints about automated nuisance calls reached 4,734 in October.

The lesson for any firm that buys a marketing list is that the buyer carries the risk, not the seller: check the consent wording and screen numbers against the TPS before calling. Our guide to the lawful basis for processing personal data explains consent. Read the ICO announcement.

Also this week

The government updated its factsheets on the Cyber Security and Resilience Bill on 3 November and added two new ones: a planned framework for managing national security risks from vendors used by essential services such as energy, water, transport and health, and a consultation on rules for “agentic loss of control” incidents involving AI. Our guide to the bill covers who it applies to. Source: GOV.UK factsheets.

On 4 November CISA added CVE-2024-27834, a 2024 flaw in Apple’s software, to its exploited list. Apple fixed it in May 2024 in iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5 and Safari 17.5, so any company iPhone or Mac still on an older release needs updating. Source: NVD record.

The ICO’s free Data Protection Essentials training for small businesses and sole traders got a push in Northern Ireland on 30 October, with practical modules on sharing information, records and avoiding breaches. Source: ICO statement.