WordPress 7.1.4: update now, attack attempts have begun

By the NexusSec team · 3 min read · Published
Short version: WordPress 7.1.4, released on 28 October 2026, fixes a weakness in the core upgrade process that could allow remote code execution during the upgrade window, plus several stored cross-site scripting issues. Fixes were backported to every branch back to 4.7. Wordfence saw attack attempts within hours of the release. Make sure every site you run is on 7.1.4, or the fixed release for its branch.

Many business websites run on WordPress, and many update themselves automatically. Plenty do not. This post reflects what was published up to 1 November 2026.

What happened

On 28 October 2026, WordPress released 7.1.4 as a security release. The most serious fix addresses a weakness in the upgrade process that could allow remote code execution while a core update is being applied. The release also fixes several stored cross-site scripting (XSS) issues, a stored denial-of-service issue in the Interactivity API, and a flaw that let unauthenticated users find unpublished Customizer changesets. WordPress backported the fixes to every branch still receiving security fixes, back to 4.7.

The same release updated the root certificates bundled with WordPress after the eMudhra certificate revocation.

Is it being exploited?

SecurityWeek reported on 30 October that Wordfence saw exploitation attempts within hours of the fix. The first request matching its new firewall rule arrived nine minutes after the rule went live, and more than 18,500 requests aimed at the flaw were recorded in the first 21 hours. Wordfence had not reported any successful compromise.

The attack is hard to pull off. No login is needed, but the attacker has to hit a narrow window while WordPress unpacks a full core update, before its temporary files are deleted. Hard is not impossible, and attackers are clearly trying.

What to do

  1. List every WordPress site you run, including old campaign sites and microsites, and check the version under Dashboard → Updates.
  2. Update to 7.1.4, or to the latest release of your branch if you are on an older one.
  3. Check that automatic background updates actually work on each site; some hosting setups turn them off.
  4. Look for signs of compromise: administrator accounts you do not recognise, PHP files you did not put there, and requests in access logs to PHP files under wp-content/upgrade/.
  5. Update plugins and themes too. This release fixes WordPress core only.
  6. Check PHP as well. The PHP2Shell flaws disclosed in October sit below WordPress and are fixed by updating PHP itself; see PHP2Shell.

No CVE number yet

As of SecurityWeek's report on 30 October, no CVE number had been assigned to the upgrade flaw. If you see one quoted, check it against WordPress's or Wordfence's own advisory before relying on it.

Sources

Frequently asked questions

Which WordPress version fixes the upgrade flaw?

WordPress 7.1.4, released on 28 October 2026. Fixes were backported to every branch still receiving security fixes, back to 4.7.

Will automatic updates install it?

Sites that support automatic background updates update themselves, but some hosting setups disable them. Check the version on each site rather than assuming.

Can it be exploited without logging in?

Yes, no account is needed, but the attacker has to hit a narrow window while a full core update is being unpacked. Attempts were seen within hours of the release.

Does updating WordPress fix PHP2Shell?

No. PHP2Shell is in PHP itself, below WordPress. It is fixed by updating PHP on the server.

Running WordPress for your business?

Our web application testing checks your site the way an attacker would, including the WordPress core, plugins and the server underneath.

Book a free consultation