WordPress 7.1.4 fixes 22 security flaws, including unauthenticated RCE
Exploitation needs a seconds-long update window and public access to wp-content/upgrade/; older branches are patched back to 4.7.39.
66
Organization
Patchstack
- Mentions · 7d3
- Mentions · 30d21
- All mentions41
- First seenAug 17, 2026
- Last mentioned1d ago
Timeline
41 articles · newest firstWordPress 7.1.4 fixes 22 flaws, including upgrade RCE
The unauthenticated race needs a seconds-long update window and a web-reachable wp-content/upgrade directory; backports reach 4.7.39.
74
PHP2Shell flaws allow unauthenticated RCE; wild attacks reported
Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; both flaws score CVSS 9.2.
86
PHP RCE flaws CVE-2026-109618 and CVE-2026-109619 exploited in the wild
Fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 7.4, 8.0 and 8.1 get emergency source backports only.
90
Stolen TeamUpdraft keys used to backdoor connected WordPress sites
Patchstack saw attacks from October 18 using UpdraftCentral keys to install at least 99 malicious plugin variants and create admin accounts.
74
Stolen UpdraftCentral keys used to backdoor WordPress sites
TeamUpdraft says its site was breached on October 17-18, and attackers installed backdoor plugins for about 18 hours.
78
Critical PHP remote code execution flaw already under attack
Patchstack says the only current fix is upgrading PHP, with an update scheduled for October 21 at 14:00 UTC.
90
Stolen UpdraftCentral keys used to backdoor WordPress sites
TeamUpdraft says a weekend breach exposed remote-management keys; Patchstack logged backdoor plugins on connected sites.
76
Patchstack and Cloudflare report early PHP2Shell exploitation
Fixed builds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; reporting does not confirm how widely attacks succeeded.
88
Rank Math PRO downloads carried a self-restoring backdoor for about 11 hours
Copies fetched from rankmath.com between October 15 20:02 UTC and October 16 07:12 UTC can recreate a hidden backdoor; clean release is 3.0.124.
78
Stolen UpdraftCentral keys used to backdoor WordPress sites
Signed commands installed backdoor plugins from October 18 to 19; no plugin update stops it, so sites must delete UpdraftCentral keys.
78
WordPress Plugin Vulnerability Exploited in Attacks to Upload and eEecute Arbitrary PHP code
Attackers are exploiting unauthenticated Bricksforge flaw CVE-2026-85097 to upload and run arbitrary PHP.
76
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Attackers are exploiting critical Bricksforge flaw CVE-2026-85097 for unauthenticated file upload and code execution.
74
Critical WordPress Bricksforge Flaw Lets Unauthenticated Attackers Execute Remote Code
Attackers are exploiting unauthenticated RCE CVE-2026-85097 in the WordPress Bricksforge plugin.
82
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
Attackers actively exploit CVSS 10.0 flaw CVE-2026-85097 in Bricksforge WordPress plugin for unauthenticated RCE.
82
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin
Attackers are exploiting CVE-2026-85097, a CVSS 10 file-upload flaw in the Bricksforge WordPress plugin.
71
Critical WordPress Vulnerabilities Enable XSS, SQL Injection and Data Disclosure Attacks
WordPress 7.1.3 patches stored XSS, SQL injection, and unauthenticated disclosure of private-post comments.
62
Ninja Forms plugin flaw exploited to hack WordPress sites
Hackers exploit stored XSS in Ninja Forms and a WooCommerce plugin to backdoor WordPress sites and hide admin accounts.
74
WordPress 7.1.3 Security Release
WordPress 7.1.3 patches seven flaws, including unauthenticated comment leaks and stored XSS, and is not an emergency.
64
WordPress 7.1.3 Maintenance and Security Release
WordPress 7.1.3 fixes seven vulnerabilities, including stored XSS, SQL injection, and unauthenticated disclosure of private comments.
60
Four ways back in: the WordPress XSS campaign that hides its own admin account
Attackers are exploiting stored XSS in two WordPress plugins to install hidden admin backdoors.
76
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Elementor CSRF in versions 4.3.0 and 4.3.1 can create admin accounts after one clicked link.
66
Elementor WordPress flaw lets attackers create admin accounts
Elementor 4.3.0 and 4.3.1 CSRF bug lets a malicious link create WordPress admin accounts.
66
Hackers Actively Exploiting WordPress Vulnerability to Execute Malicious Code
Attackers are exploiting WordPress LFI CVE-2026-87902 to write malicious PHP and seek remote code execution.
91
Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites
Elementor 4.3.0 and 4.3.1 have a CVSS 8.8 CSRF bug that can create a new administrator account.
76
WordPress patches a critical severity security vulnerability
WordPress patched critical unauthenticated RCE CVE-2026-87902 in 7.1.2; attackers weaponized pearcmd.php within hours of disclosure.
91
Critical WordPress Vulnerability Exploited Immediately After Disclosure
Attackers began exploiting critical WordPress path-traversal CVE-2026-87902 for remote code execution within hours of disclosure.
86
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Threat actors actively exploit critical WordPress CVE-2026-87902 (RCE) shortly after its disclosure, with confirmed exploitation attempts.
90
Hackers start exploiting critical WordPress flaw for code execution
Attackers are exploiting critical WordPress flaw CVE-2026-87902 for unauthenticated code execution.
88
CVE-2026-87902: how close is your WordPress to remote code execution?
Critical WordPress file inclusion flaw (CVE-2026-87902) allows RCE and has been present since version 4.7.0.
80
CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
Attackers probed unauthenticated WordPress LFI CVE-2026-87902 within hours of the 7.1.2 patch.
86
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
WordPress patched critical CVE-2026-87902 (CVSS 9.2), an unauthenticated flaw that can execute code on some servers.
78
WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE
WordPress 7.1.2 fixes unauthenticated LFI CVE-2026-87902 that can reach remote code execution.
78
WordPress Click2Shell flaw lets hackers execute PHP on the server
Public PoC shows WordPress Click2Shell can run PHP if an administrator opens a crafted link.
78
WordPress 7.1.1 Maintenance and Security Release
WordPress 7.1.1 patches an unauthenticated stored XSS (CVE-2026-93485) in wpautop(), exploitable via published comments, with CVSS 3.1 score 7.1.
65
PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug
Wordfence blocked over 100,000 exploitation attempts against CVE-2026-27540 in WooCommerce Wholesale Lead Capture, letting attackers upload PHP webshells to WordPress sites.
60
Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers
Critical unauthenticated PHP object injection (CVE-2026-82222) in the GiveWP WordPress donation plugin chains to remote code execution; version 4.16.7.2 fixes it.
76
Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable
Attackers actively exploit two CVSS 9.8 auth bypasses (CVE-2026-61979, CVE-2026-15981) in the miniOrange SAML WordPress plugin, forging SAML responses to become admin.
78
One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin
DigitalOcean researchers reported a critical authentication flaw in miniOrange SAML SSO WordPress plugins, allowing login as WordPress admin across seven editions.
58
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Patchstack disclosed CVE-2026-32475 (CVSS 9.0), an unauthenticated file-upload flaw in Elementor Pro enabling PHP upload and RCE; fixed in version 4.2.2.
62
Related CVEs
by mentions- CVE-2026-8790296%8.1Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2)
- CVE-2026-850973%9.8Unauthenticated file upload to RCE in WordPress Bricksforge
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-94504<1%7.2Stored XSS in Ninja Forms 3.15.3 Legacy Submission Editor
- Unauthenticated Stored XSS in WPC Product Bundles for WooCommerce
- CVE-2026-822222%10.0Unauthenticated PHP Object Injection Leading to RCE in GiveWP WordPress Plugin
- CVE-2026-15981<1%9.8The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4
- CVE-2026-61979<1%8.1Unauthenticated privilege escalation in miniOrange SAML SSO WordPress plugin
- CVE-2026-93485<1%7.1Unauthenticated Stored DOM-Based XSS in WordPress Core Affecting 4.7–7.0
Appears with
- WordPressproduct · 29
- WordPressvendor · 18
- Patchstackvendor · 7
- WordPressorganization · 5
- Bricksforgeproduct · 4
- Elementorvendor · 4
- TeamUpdraftvendor · 4
- Anthropicorganization · 4
- UpdraftCentralproduct · 4
- UpdraftPlusproduct · 4
- PHPvendor · 3
- Cloudflareorganization · 3
- Bricks Builderproduct · 3
- watchTowrorganization · 3
- Wordfenceorganization · 3
- Elementorproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.