WordPress 7.1.4 upgrade-window RCE is now on CISA's exploited list
Comments on “WordPress 7.1.4 upgrade-window RCE is now on CISA's exploited list”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
CISA added CVE-2026-119977, a race condition in WordPress core's upgrade process, to its Known Exploited Vulnerabilities catalog on November 3, recording active exploitation. While an update unpacks, a guessable copy of WordPress in wp-content/upgrade/ can let an unauthenticated attacker run code. Rated CVSS 8.1 with high attack complexity, it affects branches 4.7 through 7.1 and is fixed in 7.1.4 and backports. Patchstack advises blocking that directory at the web server, since PHP firewall plugins don't load there. Attack scale is unreported, and the dates and score were not independently verified.
Why it ranked
No. 1 of 109 with a score of 0.79. The panel rated it highest on new information (0.93) and practical relevance (0.92), lowest on audience breadth (0.65).
- AI judgeJudge 2claude-haiku-5-5
- Actively exploited unauthenticated RCE in WordPress core affecting a huge installed base, with specific technical root cause, fix details and concrete mitigation steps; actionable for many builders.
- AI judgeJudge 3gpt-5.6-luna
- A timely, actionable WordPress RCE report with exploitation confirmation, affected versions, remediation, server mitigations, and incident-response guidance. Claims are reasonably sourced, though exploit scale and some technical details remain unverified.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.79total under rubric v2.3
- Significance0.72
- Reader interest0.86
- Audience breadth0.65
- Practical relevance0.92
- Substantiated0.73
- Technical depth0.84
- New information0.93
- Counts against: Promotional0.03
- Counts against: Overclaim0.18
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.68 | 0.72 | 0.78 | 0.72 | 0.10 | +0.24 | +0.174 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.76 | 0.90 | 0.93 | 0.86 | 0.17 | +0.26 | +0.224 |
| Audience breadthHow many people who build technology does it concern? | 0.60 | 0.80 | 0.55 | 0.65 | 0.25 | +0.13 | +0.085 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.87 | 0.92 | 0.98 | 0.92 | 0.11 | +0.22 | +0.203 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.64 | 0.80 | 0.76 | 0.73 | 0.16 | +0.05 | +0.037 |
| Technical depthHow technically substantive is it? | 0.94 | 0.80 | 0.78 | 0.84 | 0.17 | +0.05 | +0.042 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.89 | 0.90 | 0.99 | 0.93 | 0.10 | +0.05 | +0.046 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.03 | 0.01 | 0.03 | 0.04 | −0.19 | −0.006 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.16 | 0.20 | 0.18 | 0.18 | 0.04 | −0.11 | −0.020 |
| Sum of contributions | +0.785 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.785 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-06/1/"><img src="https://rubric.hrih.si/badge/2026-11-06/1.svg" alt="Ranked #1 on Rubric, 6 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 5 matches source · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkDate
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026”
The source says No passage could be compared.
Source cited by the article: services.nvd.nist.gov/rest/json/cves/2.0
Couldn’t checkVersion
The fix for the WordPress core upgrade race condition shipped in WordPress 7.1.4 on October 28, with backports for older branches.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The fix shipped in WordPress 7.1.4 on October 28, with backports for older branches”
The source says No passage could be compared.
Source cited by the article: wordpress.org/news/2026/10/wordpress-7-1-4
Couldn’t checkNumber
CVE-2026-119977 was scored 8.1 on CVSS 3.1 by Wordfence, which filed the CVE, with attack complexity rated high.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Wordfence filed the CVE and scored it 8.1 on CVSS 3.1, and rated attack complexity as high”
The source says No passage could be compared.
Source cited by the article: services.nvd.nist.gov/rest/json/cves/2.0
Matches sourceCausal conclusion
Versions before 7.1.4 named the unpacked upgrade folder after the package, making the path guessable, and the cleanup step removed the index.php that prevents directory listing.
The cited source says the same thing.
The article says “versions before 7.1.4 named the unpacked folder after the package, so the path was easy to guess, and the cleanup step that ran first removed the index.php”
The source says “Until 7.1.4 the extraction folder took its name from the package, so for anything uploaded through the admin the name was fully predictable. The cleanup routine that runs first deleted…”
Source cited by the article: patchstack.com/articles/wordpress-7-1-4-security-release
Matches sourceVersion
The 7.1.4 fix adds 16 random characters to the extraction folder name, recreates index.php inside it and no longer deletes it during cleanup.
The cited source says the same thing.
The article says “The fix in 7.1.4 adds 16 random characters to the name of the extraction folder, recreates index.php inside it and no longer deletes that file during cleanup”
The source says “7.1.4 appends 16 random characters to the folder name, recreates index.php and stops deleting it”
Source cited by the article: patchstack.com/articles/wordpress-7-1-4-security-release
Matches sourceNumber
Patchstack says the vulnerable code goes back to WordPress 2.8 and that any update, including unattended ones, reopens the window.
The cited source says the same thing.
The article says “Patchstack notes the vulnerable code goes back to WordPress 2.8 and that any update, unattended ones included, opens the window again”
The source says “the sink dates back to WordPress 2.8, and the window returns on every update, including unattended ones”
Source cited by the article: patchstack.com/articles/wordpress-7-1-4-security-release
Matches sourceNumber
WordPress 7.1.4 fixes 22 vulnerabilities across 17 advisories by WordPress's count, up from seven in 7.1.3 three weeks earlier.
The cited source says the same thing.
The article says “7.1.4 fixes 22 vulnerabilities across 17 advisories by WordPress's count, as reported by Patchstack, up from seven in 7.1.3 three weeks earlier”
The source says “WordPress 7.1.4 came out on 28 October 2026 with fixes for what WordPress counts as 22 vulnerabilities across 17 advisories. 7.1.3 , three weeks ago, had seven”
Source cited by the article: patchstack.com/articles/wordpress-7-1-4-security-release
Matches sourceCausal conclusion
A PHP-level firewall plugin does not protect against this bug because the staged copy boots from its own bundled WordPress files and loads no firewall code from the live site.
The cited source says the same thing.
The article says “A PHP-level firewall plugin does not help here. Patchstack explains that the staged copy boots from its own bundled WordPress files”
The source says “A PHP firewall cannot block it. The extracted copy loads WordPress from its own files, and the official zip ships no mu-plugins directory, so the site’s firewall never runs for…”
Source cited by the article: patchstack.com/articles/wordpress-7-1-4-security-release
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 6 Nov 2026, 05:47 UTC. It played no part in the ranking.