WordPress 7.1.4, released on October 28, fixes a weakness in the core upgrade process that can lead to remote code execution. Wordfence says attackers are already probing for it: the firm reported blocking 62,969 attacks aimed at the flaw in a single 24-hour period, according to The Hacker News on October 30.
What happened
The WordPress.org announcement for 7.1.4 describes the issue only briefly, as a weakness in the upgrade process that can allow remote code execution during the upgrade window. It credits the report to Umut Bayram. Technical detail comes from Wordfence, as relayed by The Hacker News. Wordfence says affected versions unpack full-package core updates into a predictable, web-accessible directory under wp-content/upgrade, and that directory includes the WordPress installer.
An attacker has to hit a narrow window while WordPress is unpacking a complete core update. Wordfence lists the conditions as a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to finish before WordPress cleans up the temporary files. The window has been seen to last only seconds in normal lab environments. The report puts the CVSS score at 8.1 and says the flaw has no CVE identifier.
Wordfence says two of the largest attack sources repeatedly polled small groups of sites for roughly 14.5 hours, requesting paths such as setup-config.php.
Who is affected
The Hacker News reports that WordPress Core versions 4.7 through 7.1.3 are affected. WordPress.org says the fixes were backported to all branches eligible for security fixes, currently through 4.7, but that those backports are in progress and will ship as they are ready. Which older branch releases are fixed yet is not stated in either source. The release also contains a separate set of fixes for stored cross-site scripting and other issues.
What to do
- Update to WordPress 7.1.4 now, from Dashboard, then Updates, or by downloading it from WordPress.org. WordPress.org says sites with automatic background updates will begin updating on their own.
- After updating, look for suspicious requests to PHP files under wp-content/upgrade, plus administrator accounts, plugins or PHP files you do not recognize. This check is advice from Wordfence via The Hacker News.
- If you run an older branch and cannot move to 7.1.x, watch for the backported release for your branch. Neither source offers a workaround short of updating.
- Our analysis: because the exposure is tied to the moment of a full-package upgrade, avoid leaving upgrades half finished, and confirm after each core update that the upgrade directory is empty and cleaned up.
What we still do not know
No source we reviewed says whether any site has been compromised through this flaw. The 62,969 figure counts blocked attempts at Wordfence-protected sites over 24 hours, not successful intrusions or a total. Neither WordPress.org nor The Hacker News says whether automatic updates, which may not use the full-package path, are affected differently. Per-branch fix versions for releases older than 7.1 have not been published, and no CVE has been assigned.
Sources: WordPress.org, WordPress 7.1.4 (October 28, 2026); The Hacker News, WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours (October 30, 2026).
Leave a Reply