Attackers Are Exploiting a WordPress Upgrade Bug: A Website Checklist for Dental and Medical Practices

Most dental and medical practices run their website on WordPress, and most never think about it once the agency hands it over. On Nov. 3, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress core bug, CVE-2026-119977, to its list of vulnerabilities attackers are actively using, and gave federal agencies until Friday, Nov. 6 to deal with it. WordPress fixed it on Oct. 28 in version 7.1.4.

This one is in WordPress itself, not in a plugin or theme, and it affects versions going back to 4.7. If your practice's site hasn't been updated since late October, it's worth a five-minute check today.

What's been reported

The bug. According to the National Vulnerability Database, WordPress core versions 4.7 through 7.1.3 are affected "due to predictable, web-accessible staging paths used during full-package core upgrades," which makes it possible for attackers with no login "to execute code on the server during the upgrade window." It's rated 8.1 out of 10 (high), with the attack itself rated high complexity: it only works during that upgrade window.
The fix. WordPress released 7.1.4 on Oct. 28 as a security release, describing "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window," and recommended updating immediately. NVD's affected-version list also shows fixed releases for older branches, such as 7.0.8, 6.9.11 and 6.8.12.
Exploitation. CISA added it to the Known Exploited Vulnerabilities catalog "based on evidence of active exploitation," with a Nov. 6 due date for federal agencies. CISA's catalog entry also flags it for forensic triage, meaning agencies are expected to check whether a site was broken into before it was patched, not just install the update. BleepingComputer reports that WordPress security firm Wordfence said it "blocked 13,095 attacks targeting this vulnerability in the past 24 hours."
What isn't known. CISA hasn't said who is behind the attacks or what they do after getting in, and its catalog lists ransomware use as "unknown." No practice or other business has been named as a victim, and no patient data theft has been tied to this bug.

Why a practice should care

Your website is the front door patients use to find you, request appointments and sometimes fill out forms. If someone can run code on the server, they can change what patients see, add a fake payment or login page, send visitors to a scam site, or read what your forms collect. Even if the site doesn't touch your practice management system, a defaced or blacklisted site costs you new-patient calls and makes the practice look careless.

The other issue is ownership. Practice websites are usually built by a marketing agency, hosted somewhere else, and updated by whoever remembers to. Many WordPress sites apply security releases automatically, but some agencies switch that off, and some sites are stuck on old versions because a theme or plugin breaks on newer ones. You won't know which one you have until you check.

Clear takeaway

Confirm your practice website is on WordPress 7.1.4 (or the fixed release for its branch) this week, get the answer from your web host or agency in writing, and ask them to check the site for signs it was tampered with before it was updated.

What to do this week

Check the version. Log in to your WordPress dashboard and go to Dashboard > Updates, or look at the version number at the bottom right of any admin page. You want 7.1.4 or later. If the site is on an older branch, it needs that branch's fixed release at minimum, and you should ask why it's that far behind.
Ask whoever runs the site, in writing. Email your web host or marketing agency: "Is our site on WordPress 7.1.4 or a fixed release for its branch for CVE-2026-119977? When was it updated? Are automatic security updates turned on?" Keep the reply with your vendor records.
Ask them to look for tampering. Because CISA flagged this one for forensic triage, patching alone isn't the whole job. Ask your host or agency to check for administrator accounts nobody recognizes, plugins nobody installed, and files in the site folders that changed when no one was working on it.
Turn on automatic security updates. Unless your agency has a specific reason not to, WordPress minor and security releases should install on their own. If a theme or plugin is blocking updates, that's a problem to fix, not a reason to stay behind.
Know where your form submissions go. If patients fill out appointment requests, new-patient forms or contact forms on the site, find out where those submissions are stored and who can see them. Patient information shouldn't sit in the website's database or a plain email inbox.
Remember the server, too. Updating WordPress doesn't update the software it runs on. If you haven't already, ask your host about the PHP fixes we covered in our PHP2Shell post.
Make sure you can roll back. Confirm your host keeps daily backups of the site and that someone has restored one recently. If the site is ever defaced, a clean backup is the fastest way back.

How Brotherly Technology can help

Brotherly Technology supports dental and medical practices across their whole technology stack, including the website nobody wants to own. We can check your WordPress version, work with your agency or host to get it updated and confirmed in writing, look for signs of tampering, and make sure your online forms aren't collecting patient information somewhere they shouldn't. If you're not sure who even has the login to your site, that's a good place to start.