WordPress 7.1.4 patches 22 vulnerabilities, including an update flaw tied to code execution
WordPress 7.1.4, released 28 October 2026, fixes 22 vulnerabilities, including an update race condition that the official notice says could lead to remote code execution.
WordPress released version 7.1.4 on 28 October 2026 as a security update. The release fixes 22 vulnerabilities, according to WordPress.org, including a race condition in the core update process that the release notice says could lead to remote code execution. The notice credits security researcher Umut Bayram with the finding.
The conditions needed to exploit it have not been announced, and WordPress.org recommends that site owners update immediately.
How the race condition could be reached
During an update, WordPress extracts the update package into wp-content/upgrade/, a folder the web server can serve. Patchstack, a WordPress security firm, describes the flaw as a timing problem. An attacker must request the right path during a window lasting seconds while the update runs, and Patchstack says no login is needed.
Before 7.1.4, the folder used for uploads made through the admin had a predictable name. According to Patchstack, the cleanup routine deleted everything in that folder, including the index.php file that stops directory listing. The extracted copy also included wp-admin/setup-config.php, which runs without the site's configuration. Patchstack says an attacker could use it to run the installer against a database they control.
Version 7.1.4 appends 16 random characters to the folder name, recreates index.php and stops deleting it. Patchstack also notes a change in update-core.php that the release post does not mention, which adds wp-config.php to the files never copied out of the working directory.
Patchstack rates the attack complexity as high, and says the window returns on every update, including unattended ones. Search Engine Journal says it is not known whether authentication is required, or what access level and server conditions an attacker would need.
Which versions and sites are exposed
WordPress.org lists 7.0 and 6.9 as affected by all 22 issues. The 6.8 and 6.7 branches are affected by 20, 6.6 by 19, and 6.5 and 6.4 by 17. Branches from 6.3 to 5.9 are each affected by nine issues, and branches from 5.8 to 5.0 by six. Fixed releases are listed for each affected branch, from 7.0.8 and 6.9.11 down to 4.7.39.
Patchstack says WordPress counts 22 vulnerabilities across 17 advisories in 7.1.4. It says the previous release, 7.1.3, came out three weeks earlier and had seven. Most of the issues need a Contributor account or higher.
Sites on 4.6 or earlier receive no fix. WordPress.org says only the most recent version of WordPress is actively supported, and that fixes for older affected branches are provided as a courtesy.
What the other fixes cover
Seven of the 17 advisories share one root cause. KSES, which filters HTML for users without the unfiltered_html capability, allowed any data-* attribute with any value. Every Interactivity API directive is a data-* attribute, so a Contributor could save directives that pass filtering and run in visitors' browsers, Patchstack says.
According to Patchstack, the seven advisories cover javascript: URLs, event handler bindings, prototype pollution, object element bindings, a CSS-parsing denial of service that hangs the visitor's browser tab. The Interactivity client runtime shipped in 6.4, one release before the PHP class in 6.5, which Patchstack says is why 6.4 and 6.5 share the same count.
Users with Editor access can plant a stored cross-site scripting payload on the personal data erasure requests screen. The payload runs when an administrator opens Tools, then Erase Personal Data.
The second issue that needs no account involves unpublished Customizer changes. Patchstack says a preview request without a changeset UUID adopted the latest unpublished changeset without a capability check. Setting values stayed protected, and 7.1.4 requires the customize capability.
“The conditions needed to exploit it have not been announced.”
What site operators should do now
WordPress.org recommends that site owners update immediately. Patchstack says a PHP-level firewall cannot block the race condition, because the extracted copy loads WordPress from its own files and the official zip has no mu-plugins directory. It recommends blocking the request at the web server, denying access to wp-content/upgrade/ and turning off directory listing there.
Patchstack says the upgrade race condition and the Customizer exposure are the two issues that need no account. Patchstack also says it would not call the upgrade flaw practical to exploit.
The official announcement does not offer information about the conditions necessary to exploit the race condition.
