(1800) 30 22 32Chat with us
← All security updates

Security Update

WordPress websites and SonicWall firewalls: two flaws now used in attacks

By /

What happened

Two security flaws that are now being used in real attacks were confirmed in the past week, one in WordPress websites and one in SonicWall firewalls.

WordPress: On 28 October 2026, WordPress released version 7.1.4, a security update that fixes several issues. The most serious, CVE-2026-119977, can let an attacker with no login run their own code on the web server while a WordPress core update is in progress. It affects WordPress 4.7 through 7.1.3, and WordPress also released fixes for older versions back to 4.7. On 3 November, the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its list of flaws known to be exploited in attacks.

SonicWall: On 6 November, SonicWall released updates for seven flaws in SonicOS, the software that runs its firewalls. One of them, CVE-2026-19868, can let someone with valid login details get around the single sign-on check (SAML) for SSL-VPN remote access, possibly including multi-factor authentication. SonicWall says it has investigated a report of possible exploitation, and CISA listed it as exploited the same day.

Does it affect you?

If your business website runs on WordPress and isn’t yet on 7.1.4 (or the fixed version for its branch), it needs updating. Sites with automatic background updates turned on should already have the fix, but it’s worth checking.

If you have a SonicWall firewall running SonicOS, check SonicWall’s advisory for the fixed version for your model and update. The exploited flaw only matters if SAML sign-in is turned on for SSL-VPN, but the other six flaws are fixed by the same update.

What we’re doing and what you can do

For everyone:

  • In your WordPress Dashboard, go to Updates and check the version. If it’s older than 7.1.4, ask your web host or developer to update it as soon as possible. Researchers suggest blocking web access to the /wp-content/upgrade/ folder first, because on many sites the update itself runs the old, vulnerable process one last time.
  • Back up your website before updating.
  • For SonicWall firewalls, follow SonicWall’s advisory to install the fixed SonicOS release for your model.
  • Keep multi-factor authentication turned on, and don’t reuse VPN passwords anywhere else.

Not sure what your website or firewall is running? Call us on (1800) 30 22 32 or email helpdesk@alliance-net.com.au.

Sources

Scroll to Top