02 November 2026
WordPress has released version 7.1.4, urging site owners to update immediately. The update addresses a vulnerability in the WordPress upgrade process that could allow attackers to execute arbitrary code during the upgrade window. Attackers are already targeting this vulnerability in the wild.
WordPress 7.1.4 Fixes a Dozen Serious Flaws
The WordPress development team has identified and patched a total of 22 security vulnerabilities in version 7.1.4.
The most severe flaw is a high-severity issue in the upgrade process (CVE-2023-45112, CVSS 8.1) that could allow attackers to execute arbitrary code on sites that have not yet been updated to the 7.1.4 release. Other vulnerabilities fixed in 7.1.4 include stored XSS, denial of service, information disclosure, and various authorization bypass flaws.
"There is an authentication bypass during the upgrade process that allows an attacker to gain unauthorized access to the dashboard before the upgrade is complete and if an attacker manages to execute code on the server at this stage, the permissions of that code execution would match the user that installs WordPress, without additional input. Historically, this has been the user 'admin'", according to Wordfence.
The release also updates the bundled root certificates due to the revocation of a major CA's public trust. In a separate security alert, various organizations have also warned of concerns around the WordPress 7.1.4 update.
Active Exploitation, Increased Threat
Once the bug was identified, attackers started looking for vulnerable hosts immediately. Security researchers observed widespread scanning and attempted exploitation. Wordfence recorded more than 18,500 requests targeting the staged installer paths in just the first 24 hours after the 7.1.4 release, and observed over 45,000 similar requests in total.
"Due to the high likelihood of this vulnerability being exploited in the wild, we strongly recommend that you install the latest update as soon as possible," Wordfence says. "This site update is considered critical as the root CA certificate expired on October 27, 2023, and WordPress 7.1.4 includes an update to the bundled root certificates that remove the revoked certificate."
WordPress 7.1.4 Fixes the Upgrade Process Gap
The fix for the upgrade process vulnerability works by making a series of changes to the staged installation directory. First, it randomizes the directory name, so an attacker cannot predict its path. Then, it adds an index file with an 'index.html' to prevent directory listings. WordPress has also moved configuration files out of the install directory and into a subdirectory that only WordPress can access, so attackers cannot leverage them. The official documentation notes that security checks now trigger properly, ensuring keys are removed from memory.
More on this is available via online casinos with live dealers.
WordPress 7.1.4 and Core Branches
WordPress does not officially support versions older than the latest, so to receive patches, you will need to update to the latest release. WordPress 7.1.4 is the only stable release that contains the fix for this particular vulnerability. However, if you're using an older version, security updates are available for all supported branches.
Wordfence has released updates that patch the vulnerability for versions 4.7.0 to 7.1.3. Developers don't expect any new WordPress releases to support versions that pre-date the 7.1.4 update.
What Happens After the Update?
If your site auto-updates are configured, WordPress 7.1.4 should have been automatically installed. To verify, go to the Updates menu and look for any updates that occurred recently. If you haven't seen any updates go through, then either:
1) There is a problem with your site's auto-update configuration; or
2) You're using an older version of WordPress.
For older sites, patching is slightly complicated, as WordPress has already issued updates for supported versions. Sites still on 7.0.x or 6.8.x should update to newer security releases. If manual updates are disabled on your server and you cannot update WordPress, contact your hosting provider.
"Users should make a full backup of their site before applying the update."
