# WordPress 7.1.4 Fixes 22 Security Flaws, Including an Unauthenticated RCE (Core Update Race Condition)

> WordPress 7.1.4 (released 2026-10-28) fixes 22 vulnerabilities across 17 advisories, including a race condition in the core update process that could let an unauthenticated visitor reach the unpacked installer and achieve remote code execution. The other fixes are mostly Contributor+ stored XSS in the Interactivity API and blocks, plus an unauthenticated information disclosure, an access-control flaw and a DoS. Backports shipped for every supported branch down to 4.7.39.

- **Published:** 2026-10-29T02:47:22Z
- **Last reviewed:** 2026-10-29T02:47:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4696
- **ID:** TL-2026-4696
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

WordPress 7.1.4 is a security release published on 2026-10-28. The official release notes list 22 vulnerabilities (grouped by WordPress into 17 advisories). The same fixes were backported as courtesy releases: 7.0.8 and 6.9.11 are affected by all 22 flaws, while older branches are affected by fewer (6.8 and 6.7: 20 of 22; 6.6: 19; 6.5 and 6.4: 17; 6.3 through 5.9: 9; 5.8 through 5.0: 6; 4.9: 4; 4.8 and 4.7: 2). Backport releases run down to 4.7.39; 4.6 and earlier no longer receive security updates.

The most serious issue is a race condition during core updates, reported by Umut Bayram (Picus Security). During an update WordPress extracts the package into wp-content/upgrade/, a web-served directory. Before 7.1.4 the extraction folder name was predictable (for admin uploads it was fully derived from the package name), and the cleanup routine that runs first deleted everything in that directory, including the index.php that prevents directory listing. Per Patchstack and HOL analysis, an unauthenticated visitor who requested the right path during the few seconds of the update could reach the unpacked copy's wp-admin/setup-config.php, which boots without the site's configuration, point it at an attacker-controlled database, and plant a wp-config.php that the update would then copy over the live one, giving code execution in the document root. Patchstack rates exploitation as difficult because the window lasts only seconds and the attacker needs the update to be running and wp-content/upgrade/ to be reachable over HTTP. The fix appends 16 random characters to the temporary folder name, recreates and stops deleting index.php, and adds wp-config.php to the files never copied from the working directory (class-wp-upgrader.php, update-core.php).

The remaining fixes cover: an Editor+ stored XSS in the personal data erasure requests screen and a hardening fix for unescaped usernames on multisite Network Users screens (both reported by Anthropic); Contributor+ stored XSS via whitespace in block delimiters and in Customizer selective refresh (Rafie Muhammad, Awesome Motive); several Contributor+ Interactivity API issues (javascript: URLs in bindings, event handler bindings, prototype pollution in context namespaces, object elements loading admin pages, and stored XSS/DoS in bindings) reported by rekter0, Luis Herranz, Jon Surrell, Marcel Karlsson, Alex Concha, AnC and DatNLQ (VietSunshine Cyber Security) and others; an Author+ stored XSS in the Interactivity Router via uploaded text files (Anas Cherni); XSS in labels of Comments Pagination and Post Navigation Link blocks; Categories block XSS via format string injection and unsafe preg_replace() replacements in Image and Playlist blocks (Ben Bidner); post content shadowing Script Module data via a matching element ID (Weston Ruter); an information disclosure exposing unpublished Customizer changes to unauthenticated visitors (Antonio Lorensius Silaban); a permissions flaw letting custom roles that moderate comments read, edit and delete notes on posts they cannot edit (Ramon, WordPress Security Team); and an update to bundled root certificates because of the eMudhra revocation.

No CVE identifiers, CVSS scores, public PoC, CISA KEV listing or in-the-wild exploitation were reported in the sources reviewed at publication time (2026-10-28/29). Severity HIGH is an analyst assessment: the unauthenticated RCE is high-impact but high-complexity, and most other issues need a Contributor+ account. No network IOCs exist, so no BeaconBeagle correlation applies; the IOCs below are host/web-log artifacts for hunting and exposure checks. Note that earlier 2026 WordPress core releases (7.1.2, CVE-2026-87902) were exploited within hours of patching, so prompt updating is advisable.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1078 Valid Accounts
- T1213 Data from Information Repositories

## Sources

- [WordPress 7.1.4 Fixes 22 Security Flaws, Including an Unauthenticated RCE Vulnerability](https://cybersecuritynews.com/wordpress-7-1-4-fixes-security-flaws/)
- [WordPress 7.1.4 Security Release (official announcement)](https://wordpress.org/news/2026/10/wordpress-7-1-4/)
- [WordPress Version 7.1.4 documentation (security updates, affected branches, files revised)](https://wordpress.org/documentation/wordpress-version/version-7-1-4/)
- [WordPress 7.1.4 Security Release - Patchstack](https://patchstack.com/articles/wordpress-7-1-4-security-release/)
- [WordPress 7.1.4 security release: upgrade race RCE, how to fix - HOL](https://hol.org/blog/wordpress-7-1-4-security-release-upgrade-race-rce)
- [WordPress Announces Another Security Release: Version 7.1.4 - Search Engine Journal](https://www.searchenginejournal.com/wordpress-announces-another-security-release-version-7-1-4/594798/)
- [WordPress 7.1.4 Patches 22 Vulnerabilities in Seventh Core Security Release Since July - The Repository](https://www.therepository.email/wordpress-7-1-4-patches-22-vulnerabilities-in-seventh-core-security-release-since-july)
- [WordPress 7.1.3 Maintenance and Security Release](https://wordpress.org/news/?p=21753)
- [WordPress 7.1.1 Security Update: 11 Fixes and the Backport Versions to Apply](https://aicybr.com/blog/wordpress-7-1-1-security-update-11-fixes)
- [WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE - Patchstack (prior exploited core release)](https://patchstack.com/articles/wordpress-7-1-2-security-release-unauthenticated-lfi-to-rce/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4696