Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

WordPress released version 7.1.4 on October 28, 2026, which addresses 22 security vulnerabilities. Among them is an unauthenticated remote code execution flaw that attackers are actively exploiting. Administrators should ensure the update is installed, rather than assuming automatic background updates have completed.

The official release documentation details fixes spanning stored cross-site scripting, information disclosure, authorization weaknesses, and denial of service. The most consequential issue affects the Core upgrade process, exposing a brief opportunity for attackers to execute PHP code without credentials.

According to a recent Wordfence advisory, researcher Umut Bayram reported a remote code execution (RCE) vulnerability affecting WordPress versions 4.7 through 7.1.3. This vulnerability has a CVSS score of 8.1, indicating significant potential impact, though it requires specific conditions to exploit.

When updates are performed using complete Core packages, vulnerable installations unpack files into predictable directories under wp-content/upgrade. These temporary files include the WordPress installer.

If servers allow public access and permit PHP execution within that staging directory, attackers may request the staged installer. This could lead to server-side code execution.

Successful exploitation requires attackers to locate the staging directory and complete their interaction before cleanup. Laboratory observations narrowed this window to seconds, making sustained automated polling more practical than isolated requests.

WordPress 7.1.4 randomizes staging directories, adds an index guard, and blocks unsafe promotion of staged configuration data. Unlike previously reported WordPress path-traversal RCE vulnerabilities, this attack depends on temporary upgrade artifacts rather than theme-template resolution.

According to the supplied Wordfence report, its firewall recorded the first matching exploit attempt nine minutes after deployment of a protective rule. More than 18,500 requests targeted staged setup-config.php paths during the first 21 hours.

Two prominent sources repeatedly polled small groups of websites for approximately 14.5 hours. These observations establish active exploitation attempts, not confirmed successful compromises.

The activity follows other WordPress attacks involving malicious plugins, although the entry mechanism differs.

Wordfence Premium, Care, and Response customers received protection on October 28 at 20:30 UTC. Free users are scheduled to receive the rule on November 27.

Administrators should confirm version 7.1.4 through Dashboard > Updates, or install the corresponding patched branch release. Security fixes extend through WordPress 4.7, but only the latest version is actively supported.

Wordfence users should enable Extended Protection because exploitation directly requests PHP files without loading WordPress first.

Review logs for unexpected PHP requests beneath wp-content/upgrade, investigate unfamiliar administrator accounts and plugins, and scan for unauthorized files. Firewall protection supplements patching; it does not replace the Core security update or establish that a previously exposed website remains uncompromised.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.