FHN 
WordPress released version 7.1.4 on October 28, 2026, to fix 22 security vulnerabilities. One of the most serious flaws could allow attackers to execute code remotely without logging in. The update also addresses cross-site scripting (XSS), information leaks, and permission-related weaknesses.
According to the official release announcement, security researcher Umut Bayram reported the vulnerability affecting the WordPress update process. Patchstack’s analysis covers 22 flaws documented across 17 security advisories.
Critical Flaw Could Allow Remote Code Execution
The most serious vulnerability is linked to the WordPress update process. It involves a race condition, where an attacker must act during a short period while an update is in progress.
During an update, WordPress temporarily extracts files into the wp-content/upgrade/ directory. Weaknesses in temporary folder naming and file protection could expose an installer before the update finishes.
If an attacker accesses the installer at the right time, they could potentially run the setup process using a database under their control. This could lead to remote code execution without requiring a WordPress account.
WordPress 7.1.4 improves protection by using random characters in temporary folder names, restoring index file protection, and preventing wp-config.php from being copied from the working directory. However, successful exploitation requires precise timing and access to the exposed installation files.
XSS and Access Control Issues Also Fixed
The update addresses several stored cross-site scripting vulnerabilities. These flaws could allow malicious scripts to be saved on a website and executed when visitors open affected pages.
Some issues affect the Interactivity API, block content, navigation labels, categories, and Customizer features. The update also strengthens security checks to prevent browser-based attacks and a denial-of-service issue that could cause a browser tab to freeze.
Other fixes address possible exposure of personal information, access to unpublished website changes, and improper permissions for notes attached to posts. WordPress has also improved protections for image and playlist processing.
Update WordPress to the Latest Version
Website administrators should upgrade to WordPress 7.1.4 through Dashboard → Updates → Update Now or download the release from the official WordPress website.
Sites using automatic updates may receive the patch in the background, but administrators should verify that the installation completed successfully.
Owners of older WordPress installations should check the official security documentation for the appropriate patched version. Not every supported branch includes fixes for all 22 vulnerabilities, and older releases may no longer receive security updates.
Administrators should also consider restricting public access to the wp-content/upgrade/ directory and reviewing accounts with Contributor-level permissions or higher.
Keeping WordPress updated is essential to reducing security risks and protecting websites from potential attacks.
About the Author
