> WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release

TL;DR: WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. The most serious is an unauthenticated race condition in the Core update process that can lead to remote code execution. Threat actors are already actively attempting to exploit it, so site owners should verify that WordPress has updated to 7.1.4 or the corresponding security release for their branch. Wordfence Premium, Care, and Response customers received a new firewall rule on October 28, roughly three hours after the release. Wordfence Free users will receive the same rule after the standard 30-day delay, on November 27, 2026. WordPress 7.1.4 is a security release addressing a broad set of issues in WordPress Core, including stored cross-site scripting, denial of service, information disclosure, authorization weaknesses, and a race condition that can result in remote code execution. The remote code execution vulnerability stands out because it does not require an account on the site. However, successful exploitation requires an attacker to hit a very narrow window while WordPress is unpacking a complete Core update. In normal lab environments, that window was observed to last only seconds. Attackers are nevertheless polling vulnerable paths repeatedly in an effort to catch it. Most WordPress sites should receive the security release through automatic background updates, but we strongly recommend checking your site rather than assuming the update completed. Go to Dashboard > Updates and confirm that your site is running WordPress 7.1.4 or the corresponding patched release for its branch. Wordfence Firewall Protection The Wordfence Threat Response Team deployed a new blocking firewall rule on October 28, 2026, at 20:30 UTC, approximately three hours after WordPress announced the security release. Wordfence Premium, Wordfence Care, and Wordfence Response customers received the rule immediately. Wordfence Free users will receive it on November 27, 2026, following the standard 30-day delay. Important: This exploit directly requests a staged PHP file without first loading WordPress. Sites using Wordfence should verify that the firewall is optimized with Extended Protection, which allows the firewall to run before direct PHP requests reach the requested file. Receiving the rule does not replace installing the security update. Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution 8.1 CVSS Rating 8.1 (High) Affected Version(s) Various Patched Versions 4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4 Affected Software WordPress [wordpress] Researcher Umut Bayram WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. More Details > During a Core update that uses a complete WordPress package, affected versions unpack the new files into a predictable directory beneath wp-content/upgrade. That temporary copy includes the WordPress installer. Because the staging directory is web-accessible on many servers, an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged WordPress copy and progress to PHP code execution. The severity reflects the eventual impact: successful exploitation can give an attacker the ability to execute code on the server. The attack complexity is high, though. The attacker needs a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to complete the attack before WordPress cleans up the temporary files. Most importantly, the attacker must win the race. In lab environments, the vulnerable staging directory normally remained available for only seconds. This narrow window makes a one-off request unlikely to succeed, but repeated automated polling can improve an attacker’s chances. WordPress 7.1.4 addresses the issue by randomizing the staging directory, adding an index guard, and preventing unsafe promotion of staged configuration data. The fix was also backported to affected branches through WordPress 4.7. Active Exploitation Is Already Underway Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths. Two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window. Other sources tested many staging-directory and version-name variations. Not every request used the exact vulnerable path, but the sustained polling and exact-layout probes show that attackers quickly understood the race condition and began targeting it. Other Security Fixes in WordPress 7.1.4 The detailed WordPress 7.1.4 release documentation counts 22 vulnerabilities. In addition to the upgrade-window RCE, the release addresses: Multiple stored cross-site scripting vulnerabilities involving block delimiters, the Categories block, Comments Pagination and Post Navigation labels, Customizer selective refresh, personal data erasure requests, specially crafted usernames, and Image and Playlist block handling. Several Interactivity API issues, including unsafe URL, event-handler, internal-property, and object bindings; prototype pollution; Script Module data shadowing; uploaded text-file handling in the Interactivity Router; and a persistent denial of service condition. An unauthenticated information disclosure issue that could expose unpublished Customizer changesets. An authorization weakness in the Notes REST API affecting custom roles that can moderate comments but cannot edit the post to which a note is attached. An update to bundled root certificates following the eMudhra revocation. Many of the remaining vulnerabilities require an authenticated Contributor, Author, or Editor account, and several also require a victim to view attacker-controlled content. Those prerequisites reduce their exposure compared with the unauthenticated RCE, but they do not make the issues harmless. Stored cross-site scripting can lead to account takeover or site changes when a privileged user views a malicious page. What WordPress Site Owners Should Do Verify that WordPress has updated. Install WordPress 7.1.4 or the corresponding security release for your branch. WordPress 4.6 and earlier no longer receive security updates and should be upgraded to a supported release. Confirm that the Wordfence Firewall is enabled and optimized. Extended Protection is important for the most serious vulnerability in this release because the malicious request goes directly to a PHP file without loading WordPress first. Do not rely on the firewall instead of patching. The firewall reduces exposure while you update, but installing the fixed Core version removes the vulnerable behavior. Review suspicious upgrade-directory activity if your site remained unpatched. Look for unexpected requests to PHP files beneath wp-content/upgrade, unfamiliar administrator accounts, unexpected plugins, or PHP files you did not place there. Run a Wordfence scan after updating. This can identify unexpected Core changes, malicious files, and other signs that require investigation. Conclusion WordPress 7.1.4 is an important security release. Its most serious vulnerability can lead to unauthenticated remote code execution, but only during a narrow race window while a complete Core update is being unpacked. Attackers are already polling sites repeatedly in an effort to catch that moment. Wordfence Premium, Wordfence Care, and Wordfence Response customers received our firewall rule on October 28, 2026. Wordfence Free users will receive the same protection on November 27, 2026. Sites using Wordfence should verify that Extended Protection is enabled, and every site owner should confirm that WordPress has been updated to a patched release. We thank Umut Bayram for responsibly reporting the upgrade-window vulnerability, the WordPress Security Team for coordinating the release, and all of the researchers whose work made WordPress 7.1.4 possible. Sign up for the Wordfence mailing list to receive important WordPress security news and vulnerability reports as soon as they are published. The post WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release appeared first on Wordfence.