Updating your website is meant to be the safe thing to do. This week it became the risky moment.
A newly fixed flaw in WordPress, the software behind a huge number of small business websites, opens a door only during the few seconds a site is updating, and attackers are already knocking on it at scale.
The fix is simple, but the order you do things in matters.
What happened
On 28 October WordPress released version 7.1.4, a security update fixing what it described as "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window". Remote code execution means an attacker can run their own code on your web server, which is about as bad as website flaws get.
The flaw has since been tracked as CVE-2026-119977 and given a severity score of 8.1 out of 10. According to SOC Prime, the CVE record was published on 31 October. Several security outlets report that the US cyber agency CISA added it to its list of actively exploited vulnerabilities on 3 November, giving US federal agencies until today, 6 November, to patch. That deadline doesn't apply to UK businesses, but the attacks don't care where you are.
Security firm Wordfence saw more than 18,500 requests probing for the vulnerable files in the first 21 hours, according to SOC Prime. Later daily counts reported by different outlets range from around 13,000 to over 60,000 blocked attempts, depending on the source and the day. So far no confirmed break-ins have been named, but the scanning is clearly automated and widespread.
How a website update becomes the way in
When WordPress updates itself, it unpacks the new version into a temporary folder on your server, then copies it over the live site. Picus Security, whose researcher Umut Bayram found the bug, explains that during those few seconds the unpacked files can be reached from the internet. One of them is the setup page you see when you first install WordPress.
If an attacker hits that page at exactly the right moment, they can feed it their own settings. Those settings get copied over your real ones, pointing your site at a database the attacker controls. From there they can make themselves an administrator, upload a plugin and run whatever code they like. No password is needed.
The window is tiny, which is why the flaw is rated as hard to pull off. But attackers don't need to watch your site. They just keep trying, over and over, across thousands of sites, until one lands during an update.
There's one more twist. Picus warns that the jump from an older version to 7.1.4 is itself carried out by the old, unfixed updater, so that first update can still be exposed. Version 7.1.4 fixes the problem by giving the temporary folder an unguessable name and making sure your settings file is never overwritten. WordPress says fixes are being back-ported to older branches back to 4.7 as they become ready.
What this means for UK small businesses
If your website runs on WordPress, you're in scope. That includes sites built years ago by a freelancer or agency who no longer looks after them, and sites where nobody is quite sure who has the login. Those are exactly the sites where updates slip.
The risk isn't only a defaced homepage. An attacker with control of your site can add fake payment pages, plant malware for your customers, send spam from your domain or use your server to reach other systems. For a small firm, the website is often the shop window, the booking system and the contact form all in one.
What to do this week
Find out which version you're on. Log in to your WordPress dashboard and look at Updates. If it says anything below 7.1.4 (or an older branch without its latest security release), you need to act.
Ask whoever hosts or manages your site to block the upgrade folder first. Both Picus and Tech Insider recommend blocking web access to the wp-content/upgrade/ folder before updating an unpatched site, then running the update. It's a one-line change for a developer or a good host.
Then update, and leave automatic updates on. WordPress says sites that support automatic background updates will start the update by themselves. Once you're on 7.1.4, future security fixes should arrive on their own.
Check for signs someone got in. Look for administrator accounts you don't recognise, plugins you didn't install and new files you can't explain. Your host can search the web logs for requests to wp-content/upgrade/, which is what the scanning looks like.
Write down who owns the website. Name the person or company responsible for updates, and make sure you, not just them, have an admin login. If that person has moved on, today is the day to find a replacement.
Sophia Says
This one stings a bit, because "keep your website updated" is the advice I give most often, and here the update itself was the weak spot for a few seconds. I still want you to update. The lesson isn't that patching is dangerous; it's that attackers are scanning every WordPress site, all day, waiting for any gap. The sites I worry about most aren't the ones that update promptly. They're the forgotten ones that nobody has logged into for a year.
That's where HackRisk helps. Our Recon Scan finds the websites and services your business has facing the internet, including the old microsite someone built for a campaign years ago. Our Vulnerability Scan flags out-of-date software like an unpatched WordPress before an attacker's scanner does, so you know which sites need attention and who to call. You can't protect what you can't see.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Forgotten or unmanaged websites: Recon Scan maps the websites, subdomains and services your business exposes online.
Out-of-date WordPress and plugins: Vulnerability Scan spots known weaknesses in what you run, so updates don't slip.
Web agencies, hosts and IT providers: Supply Chain Risk shows how exposed the firms that look after your website are.
Stolen admin logins: Dark Web Scan watches for your team's credentials in breach dumps, which attackers use to log straight in.
Get your free HackRisk report
Want to know whether your website is on an old version right now? Get your free HackRisk report and see what an attacker's scanner can already see.
