Software security | Vulnerabilities

WordPress 7.1.4 Fixes a No-Login Bug Hidden in Its Own Updater

WordPress fixed nearly two dozen flaws and backported the fixes to old branches; the worst can only strike during a seconds-long update window.

By Content Team

Oct 29, 2026

ON THIS PAGE

WordPress dropped version 7.1.4 on October 28, 2026, fixing 22 security vulnerabilities. The most serious is an unauthenticated remote code execution flaw in the update process itself.

The RCE stems from a race condition during updates, where predictable temp folder names and a missing index.php file could let an attacker hijack the installer using their own database. Exploitation requires zero credentials but is difficult: the attacker must hit a seconds-long update window, and the wp-content/upgrade/ folder must be reachable from the web.

The fix adds 16 random characters to folder names, restores file protections, and stops wp-config.php from being copied. Almost all the other fixes, covering stored XSS, data exposure, and permission gaps, need an account to exploit, usually at Contributor level. WordPress hasn’t reported any active exploitation.

Fixes reach every branch back to 4.7; versions 4.6 and earlier get none. Admins should update now — don’t wait for WordPress 7.2 in December.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?