WordPress 7.1.4, released on October 28, 2026, fixes 22 security vulnerabilities, including a high-severity remote code execution flaw that does not require an attacker to log in. Wordfence reports that attackers began polling vulnerable sites shortly after the release, attempting to catch the brief window created while WordPress installs a full Core update.
The vulnerability, tracked as CVE-2026-119977, affects WordPress versions 4.7 through 7.1.3 according to the NVD entry. Wordfence lists the issue as an unauthenticated upgrade-window staged-installer vulnerability with a CVSS rating of 8.1.
Why it matters
During some full-package updates, affected WordPress versions use a predictable staging location beneath wp-content/upgrade. That temporary directory can contain installer files and may be reachable through the web server. An attacker who finds the staging path and sends requests at precisely the right time could interact with the temporary installation and eventually execute PHP code on the server.
The timing requirement makes exploitation difficult. Wordfence says the staging directory normally remained available for only a few seconds in its lab environments. Even so, repeated automated requests can give attackers more opportunities to catch an update in progress. Wordfence recorded more than 18,500 requests aimed at staged installer paths during the first 21 hours after its blocking rule was deployed, although not every request used the exact vulnerable path.
The evidence confirms exploitation attempts, not successful compromise of every site that received a request. Site owners should treat the activity as a reason to verify their update status rather than assume that automatic updates completed successfully.
What WordPress 7.1.4 changes
Wordfence reports that the fix randomizes the staging directory, adds an index guard, and prevents unsafe promotion of staged configuration data. The security release also addresses stored cross-site scripting, denial of service, information disclosure, authorization weaknesses, Interactivity API issues, and an update to bundled root certificates following the eMudhra revocation.
Several of the other vulnerabilities require an authenticated account or a victim to view attacker-controlled content. Those prerequisites reduce their exposure compared with the unauthenticated remote code execution issue, but they can still matter on sites with contributor, author, editor, or other privileged accounts.
The release applies to the current branch as WordPress 7.1.4 and to patched versions of older supported branches. Wordfence’s published list includes patched releases from WordPress 4.7.39 through 6.6.11; the supplied evidence does not provide the complete branch list, so administrators should use the update offered for their specific supported branch rather than rely on a single version number.
What site owners should do
Open Dashboard > Updates and confirm that the site is running WordPress 7.1.4 or the corresponding patched release for its branch. Do not rely solely on the expectation that background updates handled the change.
Sites running WordPress 4.6 or earlier are outside the security-support range described by Wordfence and should be moved to a supported release. Administrators whose sites remained unpatched should also review server and web-application logs for unusual requests to PHP files beneath wp-content/upgrade and investigate any unexpected administrator activity.
Wordfence says its Premium, Care, and Response customers received a firewall rule on October 28, approximately three hours after the WordPress release. Free users were scheduled to receive the rule on November 27, 2026, under the service’s standard delay. Wordfence users should verify that the firewall is enabled and operating with Extended Protection, which allows it to inspect direct PHP requests before they reach the requested file.
A firewall rule is an additional layer, not a replacement for updating WordPress. Installing the patched Core release removes the vulnerable behavior and remains the primary corrective action.
Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.
Stay Updated with ToolsLib! 🚀
Join our community to receive the latest cybersecurity tips, software updates, and exclusive insights straight to your inbox!
