Threat reportVulnerabilityTL-2026-4707
WordPress 7.1.4 Security Release Patches 22 Vulnerabilities Including Core-Update Race Condition RCE and Multiple Stored XSS
WordPress 7.1.4 Security Release Patches 22 Vulnerabilities (TL-2026-4707) is a high-severity software vulnerability, first published 2026-10-29. It has no confirmed attribution, affects WordPress WordPress Core, maps to 5 MITRE ATT&CK techniques (T1059.007, T1078, T1190), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-4707
- Threat ID
- TL-2026-4707
- Severity
- HIGH
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, news - media, ecommerce, government administration, education
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in WordPress 7.1.4 Security Release Patches 22 Vulnerabilities
Malware and tooling: PHP
How WordPress 7.1.4 Security Release Patches 22 Vulnerabilities works
WordPress 7.1.4 (released 2026-10-28) fixes 22 vulnerabilities, including a race condition during core updates that could lead to remote code execution, numerous Contributor+/Author+/Editor+ stored XSS issues (largely in Interactivity API bindings), an unauthenticated disclosure of unpublished Customizer changes, and a comment-moderation permissions flaw. Backports were released for branches back to 4.7; no CVE IDs, CVSS scores or in-the-wild exploitation are published.
On October 28, 2026 the WordPress security team shipped WordPress 7.1.4 as a security release and recommended immediate updating. The release addresses 22 vulnerabilities, credited to HackerOne-program reporters including Anthropic, Rafie Muhammad (Awesome Motive), Antonio Lorensius Silaban, Umut Bayram, rekter0, Luis Herranz, Alex Concha, Weston Ruter, Ben Bidner, Jon Surrell, Anas cherni, Marcel Karlsson (whoismarcel) and Ramon of the WordPress Security Team. No CVE identifiers or CVSS scores were assigned in the vendor release notes or the GBHackers coverage, and neither source documents exploitation in the wild, public PoC code, or exploitation prerequisites.
The most severe item is a race condition during core updates that could lead to remote code execution (reported by Umut Bayram). The vendor notes list wp-admin/includes/class-wp-upgrader.php and wp-admin/includes/update-core.php among the revised files, consistent with the upgrade code path, but the notes do not describe the exploit mechanics. Public reporting states the weakness affects the upgrade process during its execution window.
The bulk of the release is client-side injection and privilege-boundary issues. Contributor+ stored XSS is fixed in: whitespace in block delimiters; Customizer selective refresh; javascript: URLs in Interactivity API bindings; Interactivity API event handler bindings; prototype pollution in Interactivity API context namespaces; and labels of the Comments Pagination and Post Navigation Link blocks. A separate Contributor+ Interactivity API bindings issue lets object elements load admin pages. Further Contributor+ XSS and denial-of-service issues in Interactivity API bindings were reported by rekter0, Marcel Karlsson, Jon Surrell and Alex Concha. An Author+ stored XSS exists in the Interactivity Router via uploaded text files, and an Editor+ stored XSS in the personal data erasure requests screen. A cross-site scripting issue in the Categories block arises from format string injection, and post content could shadow Script Module data using a matching element ID.
Other fixes: unauthenticated visitors could see unpublished Customizer changes (information disclosure); custom roles that moderate comments could read, edit and delete notes on posts they cannot edit; hardening for unescaped usernames on multisite Network Users screens; hardening for unsafe preg_replace() replacements in the Image and Playlist blocks; and an update to bundled root certificates because of the eMudhra revocation.
Branch exposure: 7.0 and 6.9 are affected by all 22 issues; 6.8 and 6.7 by 20; 6.6 by 19; 6.5 and 6.4 by 17; 6.3 through 5.9 by 9; 5.8 through 5.0 by 6; 4.9 by 4; 4.8 and 4.7 by 2. Fixed backports: 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18, 5.9.20, 5.8.19 down to 5.0.31, 4.9.35, 4.8.34 and 4.7.39. WordPress 4.6 and earlier receive no security updates. Severity HIGH is an analyst judgment based on the RCE class and the breadth of affected branches, not a vendor score.
MITRE ATT&CK techniques used in TL-2026-4707
Execution
T1059.007 Command and Scripting Interpreter: JavaScript
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Collection
T1213 Data from Information Repositories
Impact
T1499.004 Endpoint Denial of Service: Application or System Exploitation
Affected products and versions in WordPress 7.1.4 Security Release Patches 22 Vulnerabilities
- WordPress — WordPress Core
Vulnerable versions: 7.1.0-7.1.3; 7.0.x before 7.0.8; 6.9.x before 6.9.11; 6.8.x before 6.8.12; 6.7.x before 6.7.11; 4.7 through 6.6 before the listed backports
Fixed in: 7.1.4; 7.0.8; 6.9.11; 6.8.12; 6.7.11; 6.6.11; 6.5.14; 6.4.14; 5.0.31; 4.9.35
Remediation for WordPress 7.1.4 Security Release Patches 22 Vulnerabilities
Patches
- WordPress 7.1.4
- 7.0.8
- 6.9.11
- 6.8.12
- 6.7.11
- 6.6.11
- 6.5.14
- 6.4.14
- 6.3.14
- 6.2.15
Immediate actions
- Update to WordPress 7.1.4 (Dashboard > Updates) or the matching backport for your branch
- Confirm auto-updates completed on all managed and multisite installs
- Review Contributor, Author and Editor accounts and remove unneeded ones until patched
Workarounds
- No vendor workaround published; restrict untrusted Contributor+ account creation until patched
Longer-term hardening
- Run only the most recent supported WordPress branch; 4.6 and earlier receive no security updates
- Enable automatic core updates and monitor core file integrity
- Apply least privilege to editorial roles and custom comment-moderation roles
Weaknesses (CWE) in WordPress 7.1.4 Security Release Patches 22 Vulnerabilities
Timeline of WordPress 7.1.4 Security Release Patches 22 Vulnerabilities
- WordPress 7.1.2 released with one security fix (per search coverage of prior releases).
- WordPress 7.1.3 Maintenance and Security Release resolved seven security vulnerabilities.
- eMudhra announced it is leaving the TLS certificate business after weak intermediate CA keys were found; later cited as the reason for WordPress's bundled root certificate update.
- WordPress security team recommended immediate updating; reporters credited via the HackerOne program.
- WordPress 7.1.4 security release published fixing 22 vulnerabilities, with simultaneous backports from 7.0.8 down to 4.7.39.
- GBHackers published coverage noting no CVE IDs, no severity scores and no evidence of active exploitation.
Sources cited for WordPress 7.1.4 Security Release Patches 22 Vulnerabilities
- WordPress Version 7.1.4 release notes
- WordPress 7.1.4 Security Release (wordpress.org News)
- WordPress 7.1.4 Security Update Patches 22 Vulnerabilities Affecting Millions of Websites (GBHackers)
- WordPress Version 7.0.8 release notes
- WordPress Version 6.9.11 release notes
- WordPress HackerOne vulnerability disclosure program
- WordPress 7.1.3 Maintenance and Security Release
- Weak certificates from Indian CA cause cascade of updates (BankInfoSecurity)
- eMudhra faces scrutiny after weak certificate keys raise web security concerns (YourStory)
Detection coverage for TL-2026-4707
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4707 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.