WordPress 7.1.4 patches unauthenticated RCE in update window

WordPress released version 7.1.4 on 28 October 2026. According to Wordfence, the update includes fixes for 22 vulnerabilities across 17 advisories, compared to seven in 7.1.3 released three weeks prior.

The most critical flaw: RCE without account during update

The main issue is a race condition in the core update process, leading to remote code execution. No account is required to exploit it, but the attacker must strike during the narrow window of a few seconds whilst an update is in progress, and wp-content/upgrade/ must be web-accessible.

According to the mechanism detailed by Patchstack (cited by Cyber Kendra): for a few seconds, a complete WordPress copy remains accessible at a guessable URL, including wp-admin/setup-config.php, the installer, running without the site's configuration file. An attacker acting in time could launch the installer against a database under their control, within the victim's web root. Patchstack has rated the attack complexity as high, deeming it impractical to exploit, but warns: security plugins cannot block the attack, because the extracted copy loads WordPress from its own files and the site's PHP firewall never engages. The practical recommendation is to block web access to wp-content/upgrade/ at the server level and verify that the directory is not listable.

The remaining 22 issues concern stored XSS and similar vulnerabilities, but all except two require an already authenticated account, typically with Contributor role or higher.

Patched versions by branch

Branch	Patched version
7.1.x	7.1.4
7.0.x	7.0.8
6.9.x	6.9.11
up to	4.7.39
4.6 and earlier	no longer supported

Data sourced from WordPress official documentation and Webtaculos.

Exploitation attempts already observed

Patchstack observed the first attempts against the flaw on the same day of release, concluding that whoever built them worked from the public diff rather than an independent discovery, given that fixes have been public in WordPress's GitHub mirror from 08:26 CDT on the same day. No CVE has been assigned yet. The fixes are already included in WordPress 7.2 Beta 3, ahead of the 7.2 release scheduled for 8 December.

Those running WordPress hosting should verify today that automatic updates completed successfully and, if managing the web server, immediately block public access to wp-content/upgrade/.