WordPress 7.1.4 security release (Oct 28, 2026): an unauthenticated race in the core update process can lead to remote code execution and attackers are already probing for it. Which versions are fixed and what should I check?

What it is: WordPress 7.1.4, released October 28, 2026, fixes 12 security issues (WordPress.org's count) plus a bundled root-certificate update after the eMudhra CA revocation. The most serious is a weakness in the core upgrade process: during a full core update, files were unpacked into a predictable staging location that is often reachable from the web, giving an unauthenticated attacker a narrow window to get code executed. Wordfence reports attackers began probing for it within minutes of its firewall rule going live (thousands of requests to staged setup-config.php paths in the first day), though it had not seen successful compromises; no CVE had been assigned at the time. The other fixes are mostly stored XSS, plus a denial of service and an information disclosure (unpublished customizer changes visible to visitors). The fix randomizes the staging directory and blocks unsafe use of staged configuration. Am I affected: - WordPress sites below 7.1.4, or older branches without their new security release (fixes were backported to all branches still receiving security updates, back to 4.7; WordPress says backports roll out as they're ready). - Check Dashboard > Updates, or wp core version with WP-CLI. Fix: 1. Update now: Dashboard > Updates > Update Now, or wp core update. Sites with automatic background updates enabled update themselves; confirm it happened. 2. If you're on an old branch, update to its latest security release, and plan the move to the current version, which is the only one fully supported. 3. Keep the site's web-writable directories from executing unexpected PHP, and use a web application firewall if available. 4. Check for signs of tampering if your site updated core recently while unpatched: unexpected PHP files in the WordPress root or upgrade/staging folders, new admin users and changed wp-config.php. Verify: Dashboard > Updates (or wp core version) shows 7.1.4 or the latest security release for your branch, and wp core verify-checksums reports no modified core files. Sources: https://wordpress.org/news/2026/10/wordpress-7-1-4/ https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/ https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/