Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoChighExploited in the wild

WordPress 7.1.4 fixes upgrade-window RCE as probes surge

7 sources · 9 articlesFirst reported Updated ()1 · 1 read
What's new

October 30: The Hacker News, citing Wordfence, says 62,969 attack attempts were blocked in 24 hours, up from more than 18,500 requests logged in 21 hours.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

WordPress 7.1.4 and backports through 4.7.39 are out; Wordfence reports tens of thousands of upgrade-window probes and no confirmed compromises.

WordPress 7.1.4, released October 28, 2026, fixes 22 core issues, including an unauthenticated race during a complete core update. Versions 4.7 through 7.1.3 unpack the installer under a predictable wp-content/upgrade path; a request in that seconds-long window can execute PHP if the path is web-reachable. Most stored cross-site scripting bugs, including several Interactivity API issues, need a Contributor or higher account. Wordfence rates the race CVSS 8.1; no CVE is assigned, and Patchstack calls the attack impractical. Wordfence has logged active probing, including 62,969 attempts blocked in 24 hours according to The Hacker News, but has not confirmed compromises.

Key facts
  • Affected core is 4.7 through 7.1.3; 4.6 and earlier stay unpatched.
  • Backports include 7.0.8, 6.9.11, and branches down to 4.7.39.
  • Umut Bayram reported the race; Wordfence scores it CVSS 8.1 with no CVE.
  • The fix randomizes the staging folder, restores index.php, and stops copying wp-config.php out.
  • Wordfence Premium rules shipped October 28 at 20:30 UTC; free users are set for November 27.
  • WordPress 7.2 is planned for December 8, 2026; Beta 3 already includes applicable fixes.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 28, 2026WordPress 7.1.4 and same-day backports released. · Patchstack
  2. Oct 28, 2026Wordfence paid firewall rule deployed at 20:30 UTC. · Wordfence
  3. Oct 30, 2026Wordfence reports more than 18,500 probe requests in 21 hours. · Cyber Security News
  4. Oct 30, 2026Wordfence says it blocked 62,969 attempts in 24 hours. · The Hacker News
  5. Nov 27, 2026Wordfence free users scheduled to receive the firewall rule. · Wordfence
  6. Dec 8, 2026WordPress 7.2 planned; Beta 3 already includes applicable fixes. · WordPress.org

What each outlet adds

beyond the shared facts
  • PatchstackCounts 17 advisories and says a PHP firewall will not see the request.
  • WordPress.orgLists stored XSS areas, customizer exposure, and the eMudhra certificate update.
  • WordfenceRates CVSS 8.1 and says attempts started nine minutes after its rule.
  • GBHackersBreaks out 6.8.12 and 6.7.11 as fixing 20 branch-specific issues.
  • The Hacker NewsRaises the Wordfence block count to 62,969 attempts in 24 hours.
Vendors
WordPress
Products
WordPress CoreWordfence
Organizations
WordfenceDefiantAnthropicPatchstackAwesome Motive

Coverage

oldest first · one row per article · UTC
  1. · 2d ago WordPress.org · SecurityFirst report

    WordPress 7.1.4 fixes upgrade RCE and multiple stored XSS bugs

    Fixes are being backported through the 4.7 line, and automatic background updates should install 7.1.4.

  2. · 2d ago Patchstack

    WordPress 7.1.4 fixes 22 flaws, including upgrade RCE

    The unauthenticated race needs a seconds-long update window and a web-reachable wp-content/upgrade directory; backports reach 4.7.39.

  3. · 1d ago Cyber Security News

    WordPress 7.1.4 fixes 22 security flaws, including unauthenticated RCE

    Exploitation needs a seconds-long update window and public access to wp-content/upgrade/; older branches are patched back to 4.7.39.

  4. · 1d ago GBHackers

    WordPress 7.1.4 patches 22 flaws, including an upgrade-window RCE

    Supported branches should install 7.1.4 or the matching legacy release; the advisory assigns no CVE IDs or scores.

  5. · 1d ago Wordfence

    WordPress 7.1.4 fixes unauthenticated upgrade-window RCE under attack

    Core 4.7 through 7.1.3 is affected; attackers poll a seconds-long staging window during full updates.

  6. · 18h ago Cyber Security News

    WordPress update RCE attacked hours after the 7.1.4 patch

    Wordfence logged more than 18,500 requests to temporary installer paths in 21 hours; Core 4.7 through 7.1.3 is affected.

  7. · 16h ago GBHackers

    WordPress 7.1.4 fixes 22 flaws, including RCE under attack

    Wordfence says unauthenticated RCE in WordPress 4.7 through 7.1.3 drew more than 18,500 exploit requests in 21 hours; successful compromises are not confirmed.

  8. · 12h ago SecurityWeek

    Attackers target fresh WordPress core update flaw hours after patch

    The unauthenticated race condition can yield remote code execution only during a short core-update window; Wordfence has not confirmed compromises.

  9. · 10h ago The Hacker News

    Attackers probe WordPress core race; 62,969 attempts in a day

    Unauthenticated attackers can reach the installer under wp-content/upgrade only while a full core package is unpacking.