Security Alert: WordPress Security Update - October 2026

Wordfence has released security updates for WordPress Core, plugins, and themes to address multiple vulnerabilities, including the high‑severity CVE-2026-119977 in WordPress Core, which enables attackers to run arbitrary code on servers without authentication.

Affected Systems:

The affected systems and versions include, but are not limited to:

• WordPress Core: versions prior to 7.1.4

• WordPress Plugins: 

  • addon elements for Elementor page builder: versions prior to 1.14.5

  • WP Directory Kit: versions prior to 1.6.1

• WordPress Theme :

  • Avada Website Builder For WordPress & WooCommerce: versions prior to 7.16.4

Security Risks

Exploitation of these vulnerabilities can enable arbitrary code execution, privilege escalation, or script injection, resulting in site compromise, data exposure, and operational disruption.

Recommended Actions

The National Cyber Security Authority (NCSA) recommends users and system administrators to:

• Update as soon as possible to the latest supported versions of all affected WordPress components to address known vulnerabilities and reduce the risk of exploitation.

   The WordPress components versions available for upgrade include, but are not limited to:

• WordPress Core: Upgrade to version 7.1.4 or above

• Wordpress Plugins:

  • addon elements for Elementor page builder: Upgrade to version 1.14.5 or above

  • WP Directory Kit: Upgrade to version 1.6.1 or above  

• Wordpress Theme:

  • Avada Website Builder For WordPress & WooCommerce: Upgrade to version 7.16.4 or above

• Before updating or patching, please ensure that you have the latest backup that can easily be restored. 

For further information and support, please contact the National Cyber Security Authority (NCSA) by email to rwcsirt@ncsa.gov.rw or call us on 9009.

References

• Wordfence Security Advisories

• WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

• WordPress.org – Official Release Notes