Install WordPress 7.1.4, LiteSpeed Cache 7.9.2, weDevs Project Manager 4.1.2, and GiveWP 4.19.0.1 this November. Watch LatePoint Appointment Booking for a new fix if you run version 5.7.6 or earlier.
A security patch is a fixed version that closes a known flaw. These five items cover remote takeover, checkout-data leaks, and hidden-content exposure. One core flaw is under active attack.
Table of Contents
- Patch WordPress core first
- Is your store leaking other shoppers' carts?
- Why is Project Manager an emergency?
- Are donations and bookings exposed?
- In what order should you patch?
- Frequently Asked Questions
Patch WordPress core first
Update to WordPress 7.1.4 immediately. It fixes CVE-2026-119977, a time-of-check time-of-use race condition in core updates. The flaw allows unauthenticated remote code execution on versions 4.7.0 through 7.1.3. Picus Security describes the update mechanism itself as the attack path in its analysis of the core update flaw. That makes this different from a normal plugin bug.
Any unauthenticated visitor could trigger it without logging in. Risk is not theoretical. The Hacker News reports that CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 3, 2026, in its CISA exploitation notice. Federal systems faced a November 6 remediation deadline. Treat all unpatched sites as potential targets.
Is your store leaking other shoppers' carts?
LiteSpeed Cache 7.9.2 fixes CVE-2026-93389, an unauthenticated sensitive-information disclosure. It can return another shopper's cached WooCommerce cart or checkout data. Exposed fields include name, address, email, phone, and cart tokens. LiteSpeed Technologies limits the exposure to sites with Cache > Cache > Cache REST API set to ON plus active WooCommerce cart or checkout use, according to its security update for LSCWP.
That setting narrows the victim pool. Default-configuration stores using that option remain at risk. Update the plugin, then purge cache. Check orders placed during the exposure window for privacy complaints. Consider rotating affected customer tokens where WooCommerce supports it.
Why is Project Manager an emergency?
weDevs Project Manager 4.1.2, released October 29, 2026, fixes CVE-2026-116512. It is a CVSS 9.8 unauthenticated remote-code-execution flaw in the REST API. It affects version 4.1.1 and earlier with more than 5,000 installs. ThreatWire reports that a weaponized public exploit appeared on GitHub on November 1, 2026, in its patch alert for Project Manager.
The script automates passwordless webshell installation. Unpatched sites face mass-exploitation risk. Do not wait for a maintenance window. Update to 4.1.2, then scan for unknown administrator accounts, new files, and scheduled tasks. Restore from a clean backup if you find a webshell.
Are donations and bookings exposed?
GiveWP versions before 4.19.0.1 let unauthenticated visitors view unpublished donation forms. That includes draft, pending, private, and scheduled forms. Update to 4.19.0.1 or later. The issue matters for pre-launch campaigns and private fundraisers.
Visitors could see amounts, goals, and copy before release. Review form status after updating. LatePoint Appointment Booking through 5.7.6 has CVE-2026-118066, an unauthenticated account-takeover authentication bypass. It was disclosed November 7, 2026. Install the vendor fix as soon as it is published and monitor bookings for changed staff or customer accounts.
In what order should you patch?
Patch in risk order to reduce exposure fastest. Use staging when you can, but do not delay core and Project Manager fixes for testing.
- Back up files and database, then update WordPress to 7.1.4.
- Update Project Manager to 4.1.2 and scan for webshells.
- Update LiteSpeed Cache to 7.9.2 and purge cache.
- Update GiveWP to 4.19.0.1, then check LatePoint daily for its new release.
Frequently Asked Questions
Do I need the LiteSpeed fix without WooCommerce?
No. The leak needs Cache REST API ON plus active WooCommerce cart or checkout use.
I do not use Project Manager. Am I safe from CVE-2026-116512?
Yes for that flaw. Prioritize WordPress core, cache, donation, and booking plugins instead.
What should LatePoint users do before a fix ships?
Watch the vendor release channel, restrict booking-account privileges, and update immediately on release.
