WordPress patches unauthenticated update-process flaw as attackers probe sites

WordPress released version 7.1.4 on October 28, 2026, patching a high-severity unauthenticated remote-code-execution flaw in its Core update process, and threat actors began attempting to exploit it within hours of the patch rollout. The vulnerability has not received a CVE identifier.

Defiant describes the flaw as a timing-based race condition in WordPress’s Core update process with high attack complexity. The weakness comes from predictable, web-accessible staging paths used during upgrades, where WordPress unpacks new files into a directory reachable from the web on many servers.

Defiant said authentication is not required, though exploitation depends on precise timing during the update process. The attacker must hit a narrow window while WordPress unpacks a complete Core update. Exploitation also requires a complete package update containing installer files, public web and PHP access to the staging area, a known or found staging path, and enough time before WordPress deletes the temporary files.

In Wordfence’s lab tests, the temporary folder stayed available for only seconds, so attackers must locate the correct staging path and finish the required steps before cleanup. SecurityWeek reported that Defiant, a web security firm, linked the exploitation attempts to the patch release timeline when it warned that threat actors started exploiting the flaw within hours of patches rolling out on October 28, 2026, polling vulnerable paths repeatedly to catch the seconds-long window.

Wordfence recorded more than 18,500 requests targeting temporary installer paths in the first 21 hours of monitoring, capturing the telemetry volume for the first day of monitoring. Wordfence deployed a firewall rule at 20:30 UTC on October 28, roughly three hours after the release announcement, and the first matching request arrived nine minutes later.

Wordfence has not reported any successful compromises, and its supplied report does not establish how many sites, if any, threat actors breached. Unpatched WordPress sites face immediate risk because threat actors repeatedly poll vulnerable staging paths to catch the seconds-long window before WordPress removes temporary files.

WordPress 7.1.4 randomizes the staging directory, adds an index guard, and stops unsafe handling of staged configuration information. Those are the remediation details in WordPress 7.1.4. WordPress also issued fixes for older branches back to version 4.7, and only the current release is actively supported.

Wordfence’s supplied threat report gives the flaw a CVSS severity score of 8.1, and WordPress calls the flaw high severity. Security researcher Umut Bayram reported the update-process weakness, and WordPress confirmed it in its security release announcement. The flaw affects WordPress Core versions 4.7 through 7.1.3. Coverage described an Imagick-related WordPress code-execution bug that needed Author-level access or higher.

The release also addresses 22 security defects, including cross-site scripting problems, interactivity API concerns, an unauthenticated information leak, and an authorization issue, and it refreshes bundled root certificates after the eMudhra revocation. These are the fixes included in WordPress 7.1.4.

Site owners should verify installation of the patch, and administrators can check the installed version under Dashboard > Updates. Defenders should review requests for PHP files under wp-content/upgrade, check for unfamiliar administrator accounts and plugins, and scan for unexpected file changes.

Paying Wordfence customers on Premium, Care, and Response plans received the firewall rule right away, while free users will receive it on November 27, 2026. Wordfence sites should turn on Extended Protection so the firewall loads before directly requested PHP files execute, because attacks request staged installer files directly; basic protection loads through WordPress instead.