The vulnerability
WordPress core releases from 4.7.0 to 7.1.3 put files in predictable, web-accessible locations while a full-package core upgrade is in progress. An attacker who requests those files during the upgrade can run code on the server without logging in. The attack only works while an upgrade is running, but automated tools watch for that window.
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalogue on 3 November 2026, so attacks are already happening. The CVSS score is 8.1 (high).
WordPress fixed it in WordPress 7.1.4, released on 28 October 2026. Older release branches also received security releases.
Who is affected
| How your site runs | Exposed? |
|---|---|
| A static site served by Quant, published from WordPress | Your public site is not exposed, because it is pre-rendered files with no PHP in the request path. The WordPress install that publishes to Quant still needs the update. |
| WordPress on Quant Cloud, built from our WordPress image | Your site runs the WordPress core that was in the image when you last built it. Our images include WordPress 7.1.4, so an application built before the fix is exposed until you rebuild it. |
| WordPress hosted somewhere else | Yes, unless it already runs 7.1.4 or a fixed release on its branch. |
What you need to do
If your site runs on Quant Cloud:
- Rebuild your application on our current WordPress image, then redeploy it. On Quant Cloud the WordPress core comes from the image, so update it this way and not from the WordPress dashboard.
- Check the version your site reports after the deploy, in Dashboard > Updates or with
wp core version. It must be 7.1.4. - If your application still runs PHP 7.4, plan a move to PHP 8.x (PHP 8.3 is the default). PHP 7.4 no longer receives PHP security fixes.
If your site runs somewhere else, or WordPress publishes your static site to Quant:
- Check the version in Dashboard > Updates, or with
wp core version. - If it is 7.1.3 or older, update to 7.1.4. Run the update once, at a quiet time, and confirm the new version afterwards.
- If automatic background updates are turned off, turn them back on for minor and security releases, or put a regular update check in place.
What Quant has done
Our WordPress images for PHP 7.4, 8.2, 8.3 and 8.4 include WordPress 7.1.4. They rebuild every day and take each new WordPress release that supports their PHP version.
If you are not sure which image or WordPress version your site uses, contact support and we will check it with you.