WordPress 7.1.4 fixes RCE as attackers probe sites
WordPress 7.1.4, released on October 28, 2026, fixes 22 security vulnerabilities, including a remote code execution flaw that could let an attacker run code on a website’s server without having an account. Wordfence reports that attackers began probing for the vulnerability within minutes of a new firewall rule being deployed, making it important for site owners to confirm that their installation actually received the security update.
The most serious issue is CVE-2026-119977, rated 8.1, or High, under the Common Vulnerability Scoring System (CVSS), a standard scale for assessing security flaws. It affects WordPress Core, the main software underlying a WordPress site, from version 4.7 through 7.1.3. The vulnerability is an unauthenticated race condition, meaning an attacker without an account must act during a very brief and precisely timed sequence of events. Successful exploitation can result in remote code execution (RCE), which allows code to be run on the server from elsewhere.
The vulnerable moment occurs during a Core update that uses a complete WordPress package. Affected versions unpack the replacement files into a predictable temporary directory under wp-content/upgrade. This staged copy, meaning files prepared temporarily before being put into service, includes the WordPress installer. On servers where that temporary directory is reachable from the web, an attacker can request the installer while the update is in progress, interact with the staged WordPress copy and advance toward executing PHP, the programming language used to run WordPress.
Several conditions must align. The update must use a full package containing the installer, the staging directory must permit public web and PHP access, the attacker must predict or discover its path, and the process must remain available long enough to complete the attack before WordPress deletes the temporary files. Laboratory observations cited by Wordfence found that the exposed directory normally existed for only seconds. A single request is therefore unlikely to land at the correct moment, but repeated automated requests can increase the chance of winning the race.
WordPress 7.1.4 changes that process by randomizing the temporary directory, placing a protective index file in it and blocking unsafe promotion of staged configuration data. The fix was also backported to branches as old as WordPress 4.7. Patched releases are 4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8 and 7.1.4. WordPress 4.6 and earlier no longer receive security updates and must be moved to a supported release.
Wordfence says it deployed a firewall rule at 20:30 UTC on October 28, about three hours after WordPress announced the release. A firewall is software that examines requests and blocks traffic matching harmful patterns. Wordfence Premium, Care and Response customers received the rule immediately, while Wordfence Free users are scheduled to receive it on November 27, 2026, after the standard 30-day delay. The first match appeared nine minutes after deployment. During the following 21 hours, Wordfence recorded more than 18,500 requests aimed at staged setup-config.php installer paths.
Two of the largest request sources repeatedly checked small groups of sites for about 14.5 hours, behavior that Wordfence says was consistent with attempts to catch the short update window. Other sources tried numerous staging-directory and version-name variations. Not every request matched the precise vulnerable path, but the sustained polling and probes following the expected directory layout showed that attackers had begun targeting the timing flaw.
Sites using Wordfence need its Extended Protection mode for this specific rule to act early enough. The exploit requests a staged PHP file directly instead of loading WordPress first, so the firewall must run before the requested file is reached. Wordfence stresses that this rule is not a replacement for updating, because installing a patched Core release removes the vulnerable behavior itself.
The other fixes cover several security categories. WordPress lists stored cross-site scripting, in which harmful browser code is saved on a site and later runs when someone views the affected content, involving block delimiters, the Categories block, Comments Pagination and Post Navigation labels, Customizer selective refresh, personal-data erasure requests, specially constructed usernames, and Image and Playlist block handling.
The release also addresses Interactivity API problems involving unsafe URL, event-handler, internal-property and object bindings. The Interactivity API is a WordPress interface used to add interactive behavior to pages. Related fixes cover prototype pollution, which allows data to alter properties inherited by other software objects, Script Module data shadowing, uploaded text-file handling in the Interactivity Router and a persistent denial of service condition that could keep a service from functioning normally.
Further fixes address unauthenticated disclosure of unpublished Customizer changesets and an authorization weakness in the Notes REST API. A REST API is an interface through which software sends web requests to another application. The Notes flaw affects custom roles allowed to moderate comments but not edit the post carrying a note. WordPress also updated its bundled root certificates, trusted records used to verify secure connections, following the eMudhra revocation.
Many of these additional vulnerabilities require a logged-in Contributor, Author or Editor account, and some also require a victim to open attacker-controlled content. Those requirements limit exposure compared with the unauthenticated RCE, but stored cross-site scripting can still enable account takeover or unauthorized site changes when a privileged user views a malicious page.
Site owners should open Dashboard, select Updates and confirm that the displayed version is 7.1.4 or the patched release for their branch rather than assuming the automatic background update succeeded. If a site remained unpatched, administrators should review requests to PHP files under wp-content/upgrade and investigate unfamiliar administrator accounts, unexpected plugins or PHP files they did not install. Wordfence also recommends running its scan after updating to look for altered Core files, malicious files and other evidence needing investigation.
For organisations that prefer a managed environment, AEU Hosting provides managed WordPress hosting secured end to end. Regardless of hosting arrangement, the essential response is to install the appropriate security release and verify that the update completed, because attackers are already repeatedly probing for the brief vulnerable moment.