Threat reportVulnerabilityTL-2026-4696
WordPress 7.1.4 Fixes 22 Security Flaws, Including an Unauthenticated RCE (Core Update Race Condition)
WordPress 7.1.4 Fixes 22 Security Flaws, Including an (TL-2026-4696) is a high-severity software vulnerability, first published 2026-10-29. It has no confirmed attribution, affects WordPress WordPress Core, maps to 5 MITRE ATT&CK techniques (T1059, T1059.007, T1078), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4696
- Threat ID
- TL-2026-4696
- Severity
- HIGH
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, news - media, ecommerce, government administration, education
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in WordPress 7.1.4 Fixes 22 Security Flaws, Including an
Malware and tooling: PHP
How WordPress 7.1.4 Fixes 22 Security Flaws, Including an works
WordPress 7.1.4 (released 2026-10-28) fixes 22 vulnerabilities across 17 advisories, including a race condition in the core update process that could let an unauthenticated visitor reach the unpacked installer and achieve remote code execution. The other fixes are mostly Contributor+ stored XSS in the Interactivity API and blocks, plus an unauthenticated information disclosure, an access-control flaw and a DoS. Backports shipped for every supported branch down to 4.7.39.
WordPress 7.1.4 is a security release published on 2026-10-28. The official release notes list 22 vulnerabilities (grouped by WordPress into 17 advisories). The same fixes were backported as courtesy releases: 7.0.8 and 6.9.11 are affected by all 22 flaws, while older branches are affected by fewer (6.8 and 6.7: 20 of 22; 6.6: 19; 6.5 and 6.4: 17; 6.3 through 5.9: 9; 5.8 through 5.0: 6; 4.9: 4; 4.8 and 4.7: 2). Backport releases run down to 4.7.39; 4.6 and earlier no longer receive security updates.
The most serious issue is a race condition during core updates, reported by Umut Bayram (Picus Security). During an update WordPress extracts the package into wp-content/upgrade/, a web-served directory. Before 7.1.4 the extraction folder name was predictable (for admin uploads it was fully derived from the package name), and the cleanup routine that runs first deleted everything in that directory, including the index.php that prevents directory listing. Per Patchstack and HOL analysis, an unauthenticated visitor who requested the right path during the few seconds of the update could reach the unpacked copy's wp-admin/setup-config.php, which boots without the site's configuration, point it at an attacker-controlled database, and plant a wp-config.php that the update would then copy over the live one, giving code execution in the document root. Patchstack rates exploitation as difficult because the window lasts only seconds and the attacker needs the update to be running and wp-content/upgrade/ to be reachable over HTTP. The fix appends 16 random characters to the temporary folder name, recreates and stops deleting index.php, and adds wp-config.php to the files never copied from the working directory (class-wp-upgrader.php, update-core.php).
The remaining fixes cover: an Editor+ stored XSS in the personal data erasure requests screen and a hardening fix for unescaped usernames on multisite Network Users screens (both reported by Anthropic); Contributor+ stored XSS via whitespace in block delimiters and in Customizer selective refresh (Rafie Muhammad, Awesome Motive); several Contributor+ Interactivity API issues (javascript: URLs in bindings, event handler bindings, prototype pollution in context namespaces, object elements loading admin pages, and stored XSS/DoS in bindings) reported by rekter0, Luis Herranz, Jon Surrell, Marcel Karlsson, Alex Concha, AnC and DatNLQ (VietSunshine Cyber Security) and others; an Author+ stored XSS in the Interactivity Router via uploaded text files (Anas Cherni); XSS in labels of Comments Pagination and Post Navigation Link blocks; Categories block XSS via format string injection and unsafe preg_replace() replacements in Image and Playlist blocks (Ben Bidner); post content shadowing Script Module data via a matching element ID (Weston Ruter); an information disclosure exposing unpublished Customizer changes to unauthenticated visitors (Antonio Lorensius Silaban); a permissions flaw letting custom roles that moderate comments read, edit and delete notes on posts they cannot edit (Ramon, WordPress Security Team); and an update to bundled root certificates because of the eMudhra revocation.
No CVE identifiers, CVSS scores, public PoC, CISA KEV listing or in-the-wild exploitation were reported in the sources reviewed at publication time (2026-10-28/29). Severity HIGH is an analyst assessment: the unauthenticated RCE is high-impact but high-complexity, and most other issues need a Contributor+ account. No network IOCs exist, so no BeaconBeagle correlation applies; the IOCs below are host/web-log artifacts for hunting and exposure checks. Note that earlier 2026 WordPress core releases (7.1.2, CVE-2026-87902) were exploited within hours of patching, so prompt updating is advisable.
MITRE ATT&CK techniques used in TL-2026-4696
Execution
T1059 Command and Scripting Interpreter; T1059.007 Command and Scripting Interpreter: JavaScript
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Collection
Affected products and versions in WordPress 7.1.4 Fixes 22 Security Flaws, Including an
- WordPress — WordPress Core
Vulnerable versions: 7.1.x before 7.1.4; 7.0.x before 7.0.8; 6.9.x before 6.9.11; 6.8 through 4.7 before their respective 7.1.4-day backports
Fixed in: 7.1.4; 7.0.8; 6.9.11; 6.8.12; 6.7.11; 6.6.11; 6.5.14; 6.4.14; 6.3.14; 6.2.15
Remediation for WordPress 7.1.4 Fixes 22 Security Flaws, Including an
Patches
- WordPress 7.1.4
- WordPress 7.0.8
- WordPress 6.9.11
- Courtesy backports 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18, 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28, 5.0.31, 4.9.35, 4.8.34, 4.7.39
Immediate actions
- Update to WordPress 7.1.4, or the matching backport for your branch (7.0.8, 6.9.11, 6.8.12, ... down to 4.7.39)
- Confirm the installed version with 'wp core version' and that automatic background updates completed
- Deny web access to wp-content/upgrade/ and confirm the directory is not listable and contains only index.php
- Search web access logs for requests to /wp-content/upgrade/ paths, especially setup-config.php and install.php
- Verify wp-config.php (DB_HOST, DB_NAME, DB_USER and modification time) was not altered around update windows
Workarounds
- Block HTTP access to wp-content/upgrade/ at the web server or WAF until patched
- Restrict Contributor+ account issuance on unpatched sites
Longer-term hardening
- Audit Contributor+ and Author+ accounts and custom roles with comment-moderation capability
- Run core updates outside peak traffic windows and monitor access logs during updates
- Run WordPress on a supported branch; only the most recent version is actively supported
Weaknesses (CWE) in WordPress 7.1.4 Fixes 22 Security Flaws, Including an
Timeline of WordPress 7.1.4 Fixes 22 Security Flaws, Including an
- WordPress 7.0.4 security release published (per WP VIP and Pantheon release notes), the start of the 2026 H2 run of frequent core security releases.
- WordPress 7.1 released; 7.1.4 later fixes flaws present across the 7.1 branch.
- WordPress 7.1.1 security and maintenance release published (reported as 11 fixes: 7 security plus 4 bug fixes).
- WordPress 7.1.2 released as a single-fix security release for an unauthenticated path traversal/LFI leading to conditional RCE (CVE-2026-87902), later reported exploited within hours; context for heightened core patching urgency.
- WordPress 7.1.3 security and maintenance release published (7 security fixes and 4 bug fixes), the last release before 7.1.4.
- Patchstack and HOL publish analyses of the updater race: the fix randomizes the wp-content/upgrade/ folder name, restores index.php and stops copying wp-config.php from the working directory; exploitation rated difficult and no in-the-wild activity or KEV listing reported.
- Courtesy backports released for all supported branches, including 7.0.8, 6.9.11 and down to 4.7.39; WordPress 4.6 and earlier receive no fix.
- WordPress 7.1.4 security release published, fixing 22 vulnerabilities across 17 advisories, including the core update race condition leading to RCE (reported by Umut Bayram).
- Cyber Security News and other outlets report the release and urge immediate updating; no CVE IDs or CVSS scores published at that time.
- WordPress 7.2 planned (per the official 7.1.4 announcement); sites on older branches should move to a supported version.
Sources cited for WordPress 7.1.4 Fixes 22 Security Flaws, Including an
- WordPress 7.1.4 Fixes 22 Security Flaws, Including an Unauthenticated RCE Vulnerability
- WordPress 7.1.4 Security Release (official announcement)
- WordPress Version 7.1.4 documentation (security updates, affected branches, files revised)
- WordPress 7.1.4 Security Release - Patchstack
- WordPress 7.1.4 security release: upgrade race RCE, how to fix - HOL
- WordPress Announces Another Security Release: Version 7.1.4 - Search Engine Journal
- WordPress 7.1.4 Patches 22 Vulnerabilities in Seventh Core Security Release Since July - The Repository
- WordPress 7.1.3 Maintenance and Security Release
- WordPress 7.1.1 Security Update: 11 Fixes and the Backport Versions to Apply
- WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE - Patchstack (prior exploited core release)
Detection coverage for TL-2026-4696
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4696 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.