WordPress security update rattles site owners

10 November 2026

WordPress released 7.1.4 as an emergency security update in October 2023, fixing 22 vulnerabilities in the open-source CMS. The most alarming flaw in the 7.x series could let attackers take control of sites during the update process, if they can access the temporary folder used by the core update installer.

Like any large software, WordPress undergoes extensive security scanning and patching, but it moved quickly to fix the recently disclosed flaws, six of which are considered "critical." The so-called "rollback" or "reinstall" option in the core updater exposed the race condition, enabling a curious attack path.

The attacker simply needs to guess the access URL of the `wp-content/upgrade/` folder during that window. The updater extracts package archives to there, and "extraction to this directory is not an atomic move, even though doing this is hard for attackers," a WordPress developer explained in a security forum.

In 2022, WordPress had added two features to the core update system for security and usability: auto-updates triggered by the same feature flags as for plugins, and the option explicitly to install the same versions available through "auto-update." Both could create potential challenges, both from a user-interface and a code-path standpoint.

The new flaw somehow arose out of those changes. "The attack works if an update is in progress, and the attacker is on the same page as the updater," a WordPress source noted. When the updater unpacks the package, it's briefly available on the server, and that "clicked" with the existing ways an attacker might probe an update path.

Upon close examination, to conduct the attack an attacker would face a few barriers:

• The attacker must read the WP version number correctly
• The server's timezone must match
• Their scanner must request the correct package from the WordPress back end
• They have only a few seconds' window each time they guess right

WordPress mitigates or solves the problem by one key fix: on two separate occasions WordPress now completely avoids using `wp-content/upgrade/` during the upgrade. The package is now extracted to /tmp, copied in place, and only then moved into the web folder.

An attacker would still be able to read the version from the installer url at /updates/updater.php, and also trigger the known behavior by simulating an update — but if the temporary package is deleted, searched, or moved, there is far less chance the exploitable risk materializes.

The WordPress source noted that plugins, themes, or other add-ons do not need to take any immediate action, and the fix files in WP 7.1.4 will handle the distance: "We only control the folder name, and as far as a plugin or theme should be concerned, the usable folders remain consistent."

Readers who want to go further can start with GlobiGames.com.

WordPress versions as far back as 6.8 were exploitable. For users who use the tool Wordfence, this highlights how important it is to always be vigilant about upgrading. Wordfence reported 63,000+ attempts at exploitation a day after the release; two days later, as many as 18,500 requests to the installer in a single day.

What site owners should do now:

1. Roll out 7.1.4 to all WordPress instances

2. Check the Dashboard > Updates page to confirm the update

3. Run a site health check, and for hosted customers, also check the base system health

Finally, consider modernizing your hosting so that PHP version 8.2 or higher is used, since the separate security update for PHP sounded an additional alarm for affected sites.

Remember that the security team has no say over what releases hosts deem "compatible" with what WordPress version. And any exploit for these bugs would apply to 7.0 - 7.1 just as it does to 7.2 - 7.3. The hardening done in 7.1.4 is the mitigation for all.

WordPress concludes: "As a community, we forget so much of what we learned, literally and figuratively in every generation. Blogging from Amsterdam — WordCamp Europe is all about wheel-smart digital publishing in an open-source universe."