WordPress 7.1.4 Closes 22 Holes, Including Unauthenticated RCE Race Condition

Key points

• WordPress 7.1.4 addresses 22 security defects, including a pre-auth race condition in the core updater.
• The flaw can enable remote code execution; Wordfence reports threat actors are already probing.
• Site owners on older core versions face the highest exposure.
• Patch, verify the installed version, and review logs for updater abuse.

On October 28, 2026, the WordPress project pushed version 7.1.4 as a security release that resolves 22 distinct vulnerabilities. The most urgent item is a race condition in the core updater that can be reached without authentication and may allow an attacker to execute code remotely. Wordfence, which is tracking the situation, reports that threat actors have begun probing for vulnerable installations.

Any organization running an older WordPress core is in scope, but the risk is highest for site owners who delay updates or expose administrative and updater paths to the public internet. In a K-12 or government setting, that includes district websites, school portals, and departmental blogs that often run on shared hosting with limited change control.

The combination matters: an unauthenticated trigger removes the usual barrier of stolen credentials, and a race condition can be difficult to spot in routine logs. If code execution is achieved, attackers could alter content, plant persistence, or pivot toward integrated services. The other 21 flaws broaden the attack surface and raise the odds that automated scanners find a foothold before administrators finish testing.

Because exploitation attempts are already reported, this is not a routine maintenance window. Teams should confirm the installed core version, apply 7.1.4, and then verify installation rather than trusting a success message. Multisite networks and cloned environments need the same check.

Watch for unusual requests to updater endpoints, unexpected admin accounts, and file changes in wp-admin or wp-includes. Wordfence rules and virtual patching can buy time, but they do not replace the patch. Keep backups and a rollback path ready.

What to do now

1. Inventory every WordPress instance and confirm the core version is 7.1.4; treat anything older as exposed.
2. Apply the 7.1.4 update immediately, prioritizing internet-facing sites and multisite networks.
3. Verify installation after updating by checking the dashboard, version file, and core checksums rather than relying on the update success notice.
4. Review web and application logs for suspicious requests to core updater endpoints and for signs of race-condition probing; block hostile sources.
5. Update Wordfence rules and enable virtual patching where available, with alerts for exploitation attempts.
6. Back up files and databases before and after remediation, then scan for webshells, unauthorized admin users, and unexpected file changes.
7. Restrict wp-admin and updater access by IP where feasible and enforce multi-factor authentication for all administrative accounts.

Original source

Wordfence