Emergency: check your therapy practice's WordPress website today

If your therapy practice uses WordPress, ask whoever manages your website to confirm the core security update today. This matters even if your homepage looks normal and your booking button still works.

On November 3, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that attackers are exploiting a flaw in WordPress itself, tracked as CVE-2026-119977. Keeping your plugins up to date is useful, but this alert concerns the core software running the website.

The opening appears during certain full WordPress updates. New installation files are unpacked into a temporary folder that can be reachable from the internet. An attacker who reaches the staged installer at the right moment can run code on the server without a website login. Wordfence says the window can last only seconds, but attackers are repeatedly probing these paths to catch it.

The speed is striking: Wordfence recorded more than 18,500 requests targeting the flaw in the first 21 hours. Its first firewall-rule match arrived just nine minutes after deployment. These are recorded attack attempts. For perspective on the platform's reach, BuiltWith tracks about 36.5 million live WordPress websites, as checked on November 7. The number still exposed to this particular flaw has not been established.

For a therapist, the concern goes beyond a broken website. Someone who gains control could change your phone number, divert enquiries, alter what your contact form collects or redirect a prospective client away from your practice. They could also replace a genuine booking or client-portal link with a convincing fake login page. Someone arriving through a website they recognise may trust that next step.

If your EHR or client portal runs inside the affected WordPress installation, have your provider include it in the security review. If it is hosted separately, this alert does not automatically mean that system or its records were accessed. The website still matters because it may be the route your clients use to get there. A changed link could send them somewhere else. These are possible consequences of website control, not outcomes CISA or Wordfence has confirmed for your practice.

WordPress released version 7.1.4 on October 28 and recommends updating immediately; fixed releases are also available for older branches. Automatic updates may already have installed the fix, so ask for confirmation of the running version. Then ask for a check of recent update activity, unfamiliar administrator accounts, unexpected plugins and changed files. Wordfence recommends both updating and checking for signs of compromise. A completed update does not tell you whether someone got in earlier.

Editorial image using WordPress and CISA visual references, with the official WordPress mark.

Do this now:

Contact your website provider today and ask them to confirm WordPress 7.1.4 or the fixed release for your branch is installed, with protection for the temporary update folder while they apply it.
Ask them to review recent update logs, unfamiliar administrator accounts, unexpected plugins and changed files, then confirm what they checked.
Follow your enquiry, booking and client-portal links to their final destinations; if a page or login prompt looks unfamiliar, stop and contact your website and portal providers through known contact details.

Final thoughts

Your website is often the first place someone decides whether they feel comfortable contacting you. Protecting that route means protecting more than your homepage: it means checking the form they use, the booking link they follow and the portal they trust.

My recommendation is to get two things confirmed today: the security fix is installed, and someone has checked for signs of compromise. Send the three requests above to your website provider so you know what has actually been done.