On 28 October 2026 WordPress released 7.1.4, a security release it recommends installing immediately. The most serious fix is for a weakness in the core update process that can lead to remote code execution during the update window, reported by researcher Umut Bayram. Wordfence says it affects WordPress 4.7 through 7.1.3 and rates it CVSS 8.1; no CVE has been assigned yet.
How it works: during a full-package core update, affected versions unpack the new files into a predictable folder under wp-content/upgrade/, including the WordPress installer. According to Patchstack, an attacker with no account who reaches that installer in the few seconds it exists could run it against a database they control. The window opens on every core update, including automatic ones. WordPress 7.1.4 randomises the folder name, keeps an index.php guard in place and, per Patchstack, stops wp-config.php from being copied out of the working folder.
Attackers are trying. Wordfence deployed a firewall rule about three hours after the release; the first match came nine minutes later. SecurityWeek reports more than 18,500 requests for the staged installer paths in the first 21 hours, and Techaeris reports Wordfence blocked 62,969 attempts in 24 hours. Wordfence has not reported any successful compromise. Patchstack considers the attack hard to pull off in practice because the window is so short.
7.1.4 fixes 22 vulnerabilities in total (Patchstack, citing WordPress), many of them stored XSS issues, and updates the bundled root certificates after the eMudhra revocation. Fixes were backported to every branch back to 4.7 (for example 7.0.8, 6.9.11 and 4.7.39). Sites on 4.6 or older get no fix.
