WordPress has released version 7.1.4, a security update fixing 22 vulnerabilities across 17 advisories, and is urging site owners to install it immediately. The release, published on 28 October 2026, covers stored cross-site scripting, information disclosure, authorisation weaknesses and denial-of-service issues, with several flaws affecting the Interactivity API used by modern WordPress blocks.

The headline flaw: a race condition in updates

The most serious issue is a race condition in the core upgrade process, reported by security researcher Umut Bayram. During an update, WordPress extracts files into a temporary upgrade directory, and weaknesses in folder naming and file protection could expose an unpacked installer. An attacker reaching it at precisely the right moment could run setup using a database under their control, creating a path to remote code execution without a WordPress account.

Why WordPress alone is not enough

That window is narrow. Patchstack's analysis describes exploitation as difficult because the opportunity lasts only seconds and depends on public access to the upgrade directory during an update. Version 7.1.4 adds 16 random characters to temporary folder names, restores index-file protection and prevents the site's configuration file from being copied from the working directory. Most of the other 21 flaws require an account first, usually at contributor level.

The WordPress flaws are separate from the PHP2Shell vulnerabilities that CISA has added to its exploited-vulnerabilities catalogue, so updating WordPress alone will not protect a site running a vulnerable PHP version. Site owners should apply the WordPress update, check that automatic updates have run, and confirm their PHP version is patched as well. Backports of the WordPress fixes shipped the same day for supported branches down to version 4.7.39, according to Patchstack.

Sources: Cyber Security News, Patchstack.