WordPress has released 7.1.4 to fix a flaw in core updates that lets an attacker without an account run code on the server. It affects versions 4.7 to 7.1.3, and mass exploitation attempts are already under way. If your website runs WordPress, check its version today and update to 7.1.4 or your branch's patched release.
Key facts
- The flaw affects WordPress core from 4.7 to 7.1.3 and has a CVSS score of 8.1. Patches shipped on 28 October 2026 and have been backported to every branch down to 4.7, according to SecurityWeek.
- At the time of reporting it had no CVE assigned.
- Wordfence says it blocked 62,969 attacks against this flaw in 24 hours, reports The Hacker News.
- Defiant rates the attack complexity as high: the attacker has to hit a window that lasts only seconds in lab conditions.
- 7.1.4 fixes 22 security issues in total, including several XSS bugs and an unauthenticated information disclosure.
How does the attack work?
When WordPress runs a full core update, affected versions unpack the files into a predictable directory under wp-content/upgrade. That copy includes the WordPress installer.
If that directory is reachable from the web, an unauthenticated attacker can request the installer at exactly the moment it is being unpacked and end up running PHP code on your server. It is a race condition: the attacker wins by getting there before the update finishes.
The window is short, but attackers make up for it with volume. According to The Hacker News, two of the largest attack sources probed small groups of sites for around 14.5 hours, repeatedly hitting paths such as setup-config.php. They started within hours of the patch going public.
Am I affected if an agency or my host runs the site?
Yes, if the site runs any version between 4.7 and 7.1.3, which covers almost any un-updated WordPress install. Someone else managing it doesn't change the risk; it only changes who has to press the button.
If automatic updates are on, you are probably already on the fixed version, but check. If they were switched off (common, to stop plugins breaking), you stay exposed until someone updates manually.
7.1.4 also brings other changes: it fixes further security issues and updates the bundled root certificates after the recent eMudhra revocation. It is worth installing on its own merits.
What to do today
- Log in to the WordPress dashboard and check which version you are running.
- Update to 7.1.4, or to the patched release of your branch if you are on an older one.
- If you don't have access or automatic updates are off, ask your agency or hosting provider today and get written confirmation of the final version.
- Ask them to review server logs for suspicious requests to PHP files inside wp-content/upgrade.
- Review the list of admin users, plugins and PHP files. Anything you don't recognise is a sign of compromise.
- Until you are on the fixed version, don't run full core updates other than the patch itself.
- If a compromise is confirmed and the site holds customer data, remember that GDPR gives you 72 hours to notify the Spanish data protection authority (AEPD).
What it means for a small business
High attack complexity is no comfort. Attackers don't need to hit your site: they only need to try thousands and succeed on a few. Nearly 63,000 attempts in a day says exactly that.
The real risk for a small business isn't the main website someone checks every week. It's the old campaign landing page, the blog nobody touches, or the shop built by an agency you no longer work with. Those sites tend to have updates switched off, and nobody looks at their logs.
Our view: keep automatic core updates switched on unless you have a strong reason and a named person who will update manually within hours, not weeks. And take an inventory of every WordPress site carrying your brand. If you don't know how many you have, that is the first problem to solve.
If you want help reviewing your exposure, it's part of our cybersecurity service.
Frequently asked questions
Does this flaw have a CVE?
No. At the time of reporting it had no CVE assigned, but it does have a CVSS score of 8.1 and a patch available since 28 October 2026.
I'm on an older WordPress version. Do I have to jump to 7.1.4?
Not necessarily. The fixes have been backported to older branches down to 4.7. Updating to the latest release of your branch is enough.
How do I know if I've already been attacked?
Look in the server logs for suspicious requests to PHP files in wp-content/upgrade, and check for admin users, plugins or PHP files you don't recognise.
