WordPress 7.1.4 fixes 22 security flaws, including unauthenticated RCE
Original title: WordPress 7.1.4 Fixes 22 Security Flaws, Including an Unauthenticated RCE Vulnerability
Exploitation needs a seconds-long update window and public access to wp-content/upgrade/; older branches are patched back to 4.7.39.
WordPress 7.1.4, released October 28, 2026, fixes 22 security flaws. The most serious is an unauthenticated remote code execution issue: during an update, predictable temporary folders and missing index.php protection could expose an unpacked installer that an attacker might use with a database they control. The release also addresses stored cross-site scripting, data exposure, and access-control gaps. Patchstack rates the update-window attack as difficult.
Unconfirmed: The article does not say the flaws are exploited in the wild and does not name CVE identifiers.
- Umut Bayram reported the update flaw; Aaron Jorbin and Nik Tsekouras led the release.
- Temporary folder names gain 16 random characters, and index.php protection is restored.
- The update stops wp-config.php from being copied out of the working directory.
- Patched branches include 7.0.8 and 6.9.11; versions 4.6 and earlier get no fixes.
- Anthropic reported issues involving personal-data removal requests and crafted usernames.
Impact: unauthenticated remote code execution during a short update window
| Product | Affected | Fixed in |
|---|---|---|
| WordPress | — | 7.1.4, 7.0.8, 6.9.11, and releases extending to 4.7.39 |
- 1.Install WordPress 7.1.4 or the patched branch release and confirm the installed version.
- 2.Block web access to wp-content/upgrade/ at the web server.
- 3.Review accounts with Contributor privileges or higher.
- Vendors
- WordPress
- Organizations
- PatchstackAnthropic
From the original article
3 min read at cybersecuritynews.com
WordPress released version 7. 1. 4 on October 28, 2026, fixing 22 security flaws, including an unauthenticated remote code execution vulnerability in its update process.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.