WordPress 7.1.4 fixes 22 flaws, including RCE under attack
Original title: WordPress 7.1.4 Fixes 22 Security Vulnerabilities, Including RCE Flaw Under Active Attack
Wordfence says unauthenticated RCE in WordPress 4.7 through 7.1.3 drew more than 18,500 exploit requests in 21 hours; successful compromises are not confirmed.
WordPress released version 7.1.4 on October 28, 2026, fixing 22 vulnerabilities spanning stored cross-site scripting, information disclosure, authorization weaknesses, and denial of service. Researcher Umut Bayram reported an unauthenticated remote code execution flaw, CVSS 8.1, in the Core upgrade process affecting versions 4.7 through 7.1.3. When complete Core packages are unpacked into predictable directories under wp-content/upgrade, an attacker who can reach the staged installer before cleanup may execute PHP. WordPress 7.1.4 randomizes staging directories, adds an index guard, and blocks unsafe promotion of staged configuration data.
Unconfirmed: Wordfence describes active exploit attempts, not confirmed successful compromises.
- Wordfence’s firewall saw the first matching attempt nine minutes after a protective rule deployed.
- More than 18,500 requests hit staged setup-config.php paths in the first 21 hours.
- Two sources polled small groups of sites for about 14.5 hours.
- Wordfence Premium, Care, and Response got the rule on October 28 at 20:30 UTC; free users on November 27.
- Security fixes reach back through WordPress 4.7, but only the latest version is actively supported.
Impact: Unauthenticated PHP code execution during Core upgrades
| Product | Affected | Fixed in |
|---|---|---|
| WordPress | 4.7 through 7.1.3 | 7.1.4 |
- 1.Confirm WordPress 7.1.4 or the corresponding patched branch is installed.
- 2.Review logs for unexpected PHP requests under wp-content/upgrade.
- 3.Wordfence users should enable Extended Protection; free users get the rule on November 27.
From the original article
2 min read at gbhackers.com
WordPress released version 7. 1. 4 on October 28, 2026, which addresses 22 security vulnerabilities.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.