Security notice

WordPress 7.1.4 fixes a flaw in its own updater. Wordfence says attackers are trying it. Update today.

What happened

• What WordPress released. On October 28, 2026, WordPress.org announced WordPress 7.1.4. It says "this security release features fixes for multiple issues" and that "because this is a security release, it is recommended that you update your sites immediately." It says sites that support automatic background updates will update automatically. (WordPress announcement)
• A weakness in the update process itself. WordPress lists "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window." Its HelpHub page calls it a race condition during core updates. Patchstack, a WordPress security firm, explains that while an update runs, a copy of WordPress sits for a few seconds in a folder called wp-content/upgrade/. If that folder can be opened from the internet, a visitor with no account could try to reach it during that window. Patchstack says the window is tiny and that it "would not call it practical to exploit," but also says the window comes back on every update, including automatic ones. (WordPress announcement, WordPress HelpHub, Patchstack)
• Which versions, and how serious. Wordfence rates the flaw CVSS 8.1 (high), lists WordPress Core 4.7 through 7.1.3 as affected, and names fixed releases for every branch, from 7.1.4 and 7.0.8 down to 4.7.39. It says the attack complexity is high: an attacker needs a full-package update to be running, public web access to the temporary folder, a folder name they can predict or find, and enough time before WordPress cleans up. WordPress's own pages give no CVSS score. (Wordfence, WordPress announcement, WordPress HelpHub)
• Attackers are trying it, says Wordfence. Wordfence says its telemetry "shows that threat actors are already actively attempting to exploit the vulnerability." It reports "more than 18,500 requests targeting" the temporary installer files in the first 21 hours after its firewall rule went live. On October 30, The Hacker News reported, quoting Wordfence, that it "has blocked 62,969 attacks targeting the vulnerability" over 24 hours. We could not find the 62,969 figure in Wordfence's own post, which gives the 21-hour figure, so we show both and attribute each. Wordfence says two of the largest sources "repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window," and others tried many folder and version name variations. These are attempts that Wordfence saw or blocked. Wordfence's post does not report any site that was taken over, and notes that "Not every request used the exact vulnerable path." (Wordfence, The Hacker News)
• A second flaw that needs no account. WordPress lists "unpublished customizer changesets can be discovered by unauthenticated users." Patchstack says this could show an anonymous visitor a preview of the most recent unpublished design changes, and that the settings themselves stayed protected. (WordPress announcement, Patchstack)
• The rest need a logged-in account. Most of the other fixes are stored cross-site scripting flaws, meaning someone who can save content plants code that then runs in the browser of an administrator or visitor who opens it. WordPress lists them in blocks and features including the Interactivity API, the Customizer, the Categories, Playlist and image blocks, comment pagination blocks, and the privacy data erasure requests. Patchstack says almost everything else needs an account first, usually a Contributor, a few need Author or Editor, and one needs an unusual custom role. (WordPress announcement, WordPress HelpHub, Patchstack)
• Other fixes in the same release. WordPress also fixed a stored denial of service in the Interactivity API, which Patchstack says hangs the visitor's browser tab, not the server, and a permissions problem with editor notes. It also updated the root certificates built into WordPress because of the eMudhra revocation; see our eMudhra notice. (WordPress announcement, Patchstack)
• Not on CISA's list, so far. We found no CVE record for this flaw, and the CISA KEV catalog version dated October 30, 2026 has no entry for it. WordPress's announcement and Patchstack do not mention attacks. Wordfence's report of attempts is the only report of attacks we found. Details of the fix are public, so a site that has not updated should not wait. (WordPress announcement, Patchstack, Wordfence, CISA KEV)
• Older versions got fixes too. WordPress says the security fixes were backported to every branch that is still eligible, "currently through 4.7," and that only the most recent version is actively supported. Its announcement says the backports "are in progress and will ship as they become ready," but WordPress's WordPress releases page and HelpHub page already list them as released on October 28: for example 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18 and down to 4.7.39. WordPress says versions 4.6 and earlier no longer receive security updates. (WordPress announcement, WordPress HelpHub, WordPress releases page, Patchstack)

Who should worry

This is about websites built on the WordPress software you install yourself. If you are not sure whether your site runs WordPress, ask your web developer or hosting company. Ask about this if any of these are true:

• Your site runs WordPress and automatic updates are turned off, or you are not sure they are on. Attackers are now trying to catch sites in the middle of a core update.
• An agency, developer or host looks after your WordPress site and you have not heard whether they installed 7.1.4.
• Other people have accounts on your site, such as writers, contributors, authors, editors or former staff. Most of the fixes matter most when someone with a low-level account is untrustworthy or their login is stolen.
• Your site runs an older WordPress version, such as 6.x or 5.x, and has not had its latest security update.
• You run a web agency or host and look after WordPress sites for clients.

This does not replace updating PHP. WordPress 7.1.4 does not change the PHP version on your server. See our PHP notice.

What to do now

Do these today.

1. Ask the question. Send the message below to your developer, agency or host. You need a clear answer: what WordPress version does our site run, and is it on the latest security release?
2. Update WordPress. In your WordPress dashboard, open Dashboard, then Updates, and install WordPress 7.1.4 if it is offered. WordPress says the update can also be downloaded from WordPress.org. Take a backup first. (WordPress announcement)
3. If your site updates itself, check that it did. The Updates screen shows the version you are on. If it still shows an older version, update by hand and ask your host or developer why the automatic update did not run. (WordPress announcement)
4. On an older WordPress version? Install the newest release for your version from the list above, such as 6.8.12 or 6.7.11, and plan the move to the current version, because WordPress says only the most recent version is actively supported. If your site is on 4.6 or older, WordPress no longer issues security updates for it, so it needs a full upgrade. (WordPress announcement, WordPress HelpHub)
5. If you cannot update right away, ask your developer or host to block web access to wp-content/upgrade/ and check that it cannot be browsed. Patchstack says a PHP security plugin cannot stop the update-process flaw, so this has to be done in the web server. It is a stopgap, not a fix. (Patchstack)
6. Check for signs of a break-in, especially if you were not on 7.1.4 yet. Wordfence says to look for requests to PHP files under wp-content/upgrade in your server logs, and for unfamiliar administrator accounts, unexpected plugins, or PHP files you did not put there. Ask your developer or host to do this, and to run a malware scan after updating. If you find something, treat the site as compromised: restore from a clean backup, update everything and change all passwords. (Wordfence, The Hacker News)
7. If you use the Wordfence plugin, Wordfence says paying customers (Premium, Care and Response) got its firewall rule on October 28 and free users get it on November 27, that sites should confirm the firewall is optimized with its Extended Protection setting because the attack requests a PHP file directly, and that receiving the rule "does not replace installing the security update." (Wordfence)
8. Review who has an account. Remove accounts that are no longer needed and check that people with Contributor, Author or Editor access should still have it. Patchstack points to Contributor accounts as where most of these fixes start. (Patchstack)
9. Check your site afterwards. Load your main pages, test your forms and, if you sell online, place a test order.

What to send your developer, agency or host

WordPress released 7.1.4 on October 28, 2026, a security release that fixes, among other things, a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window, and a set of stored cross-site scripting flaws that need a logged-in account. WordPress recommends updating immediately. Please tell us which WordPress version our site runs, and whether it is on 7.1.4 (or the newest release for its branch). If automatic updates are on, please confirm the update actually installed. Wordfence says attackers are already trying to exploit the upgrade flaw, so please also check our server logs for requests to PHP files under wp-content/upgrade, and check for administrator accounts, plugins or PHP files we do not recognize. Please also check that web access to wp-content/upgrade/ is blocked and that the folder is not listable, and tell us who has Contributor, Author, Editor or Administrator accounts so we can remove any we do not need. If we are on 4.6 or older, please tell us the plan to upgrade. Sources: WordPress announcement, WordPress HelpHub, Patchstack, Wordfence.

Common questions

Sources

• WordPress.org news: WordPress 7.1.4, Aaron Jorbin, October 28, 2026, checked October 30, 2026
• WordPress HelpHub: Version 7.1.4, October 28, 2026, checked October 30, 2026
• WordPress.org: Releases archive, checked October 30, 2026
• Patchstack: WordPress 7.1.4 Security Release, Dave Jong, October 28, 2026, checked October 30, 2026
• Wordfence: WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release, Wordfence, October 29, 2026, checked October 30, 2026
• The Hacker News: WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours, Ravie Lakshmanan, October 30, 2026
• CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 30, 2026, checked October 30, 2026