WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release
TL;DR: WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. The most serious is an unauthenticated race condition in the Core update process that can lead to remote code execution. Threat actors are already actively attempting to exploit it, so site owners should verify that WordPress ...Read More
TL;DR: WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. The most serious is an unauthenticated race condition in the Core update process that can lead to remote code execution. Threat actors are already actively attempting to exploit it, so site owners should verify that WordPress has updated to 7.1.4 or the corresponding security release for their branch.
Wordfence Premium, Care, and Response customers received a new firewall rule on October 28, roughly three hours after the release. Wordfence Free users will receive the same rule after the standard 30-day delay, on November 27, 2026.
WordPress 7.1.4 is a security release addressing a broad set of issues in WordPress Core, including stored cross-site scripting, denial of service, information disclosure, authorization weaknesses, and a race condition that can result in remote code execution.
The remote code execution vulnerability stands out because it does not require an account on the site. However, successful exploitation requires an attacker to hit a very narrow window while WordPress is unpacking a complete Core update. In normal lab environments, that window was observed to last only seconds. Attackers are nevertheless polling vulnerable paths repeatedly in an effort to catch it.
Most WordPress sites should receive the security release through automatic background updates, but we strongly recommend checking your site rather than assuming the update completed. Go to Dashboard > Updates and confirm that your site is running WordPress 7.1.4 or the corresponding patched release for its branch.
Wordfence Firewall Protection
The Wordfence Threat Response Team deployed a new blocking firewall rule on October 28, 2026, at 20:30 UTC, approximately three hours after WordPress announced the security release. Wordfence Premium, Wordfence Care, and Wordfence Response customers received the rule immediately. Wordfence Free users will receive it on November 27, 2026, following the standard 30-day delay.