WordPress 7.1.4 security release: update flaw under active attack

WordPress 7.1.4, released on 28 October 2026, is a security release that every site owner should install now. Its most serious fix addresses a weakness in the WordPress upgrade process that can lead to remote code execution during the short window while an update is being unpacked, and Wordfence reported attackers probing for it within minutes of deploying a firewall rule. The fixes have been backported to all branches still eligible for security updates, going back to WordPress 4.7.

October was also a busy month for plugin security, with active exploitation reported against Bricksforge, Ninja Forms and a WooCommerce bundles plugin. Below is a summary of what happened and the steps worth taking. As with all our security posts, this is general information rather than advice for your specific setup.

What WordPress 7.1.4 fixes

The official release post lists a range of issues, credited to independent researchers and the WordPress Security Team. They include:

• A weakness in the upgrade process that can lead to remote code execution during the upgrade window.
• Multiple stored cross-site scripting (XSS) issues, including in specially crafted block markup, the Interactivity API, Customizer selective refresh, and the Categories, Playlist, image and comments pagination blocks.
• Stored XSS via specially crafted user logins and via privacy data removal requests.
• A stored denial of service issue in the Interactivity API.
• Unpublished Customizer changesets that could be discovered by unauthenticated users.
• Notes that could be read by privileged users who lack access to edit the post the note is attached to.

The release also updates the bundled root certificates following the eMudhra revocation. WordPress 7.2 Beta 3 was published at the same time with all applicable fixes, so anyone testing 7.2 should update their test sites too.

Why the update-process flaw is getting attention

According to SecurityWeek's report on findings from Defiant, the company behind Wordfence, WordPress unpacks new files into a predictable staging directory during a core update, and that directory is often reachable from the web. An attacker who reaches it in the few seconds before WordPress deletes the temporary files could abuse staged installer files. Attack complexity is high, but no login is needed.

WordPress 7.1.4 randomises the staging directory, adds an index guard and blocks unsafe promotion of staged configuration data. Wordfence said its new firewall rule matched its first attack nine minutes after deployment, and that it logged more than 18,500 requests targeting staged setup-config.php installer paths in the first 21 hours. At the time of SecurityWeek's report, Wordfence had not reported any successful compromises.

A flaw in the update process is not a reason to avoid updates: the fix is in 7.1.4.

Plugin vulnerabilities exploited in October

Several plugin flaws were reported as actively exploited during October 2026:

Patchstack first detected exploitation of the Bricksforge flaw on 7 October 2026. As reported by The Hacker News, attackers abused a form upload feature to write a file that is both a valid image and executable PHP, and tried variations such as .phtml and .php5 extensions to get past filters.

The Ninja Forms and WPC Product Bundles attacks, also reported by The Hacker News, used a script payload that installs a backdoor plugin and hidden administrator accounts. That detail matters: updating the plugin closes the hole, but it does not remove an infection that happened before you updated.

For wider context, The Hacker News cites Wordfence's Q2 2026 report, which counted 2,073 WordPress vulnerabilities published in that quarter alone.

What to do now

1. 1 Confirm your WordPress version. Go to Dashboard, Updates. You should be on 7.1.4, or the latest security release for your branch if you are on an older one. The release post notes that backports were still in progress and ship as they become ready.
2. 2 Check whether you use the plugins above and update them to the fixed versions, along with everything else that has a pending update.
3. 3 Look for signs of compromise if you ran a vulnerable version. Review Users for administrator accounts you do not recognise, check the plugin list and the wp-content/mu-plugins folder for anything unfamiliar, and look for unexpected PHP files in uploads folders, such as wp-content/uploads/bricksforge/tmp/.
4. 4 Review server logs for requests to staged setup-config.php paths and, if relevant, to the Bricksforge form submission endpoints.
5. 5 Keep PHP current. The PHP project also released fixes for two critical vulnerabilities on 21 October 2026. Confirm with your host that PHP has been patched.
6. 6 Consider a web application firewall, through your host or a security plugin, and keep automatic updates on for minor WordPress releases.

If you find evidence of a compromise, restoring a clean backup taken before the infection and rotating all passwords and keys is usually safer than trying to clean files one by one.

Frequently asked questions

Will my site update to 7.1.4 automatically?

The release post says sites that support automatic background updates will receive it automatically. Check Dashboard, Updates to confirm the version actually installed.

I am on an older WordPress version. Am I protected?

Security fixes were backported to branches back to 4.7, but WordPress.org says only the most recent version is actively supported. Updating to the 7.1 branch is the safest option.

Does updating a plugin remove malware?

No. An update fixes the vulnerability but leaves any backdoor, hidden admin account or injected file in place. You need to check for those separately.

The bottom line

Install WordPress 7.1.4 or your branch's latest security release, update your plugins, and spend ten minutes checking for unknown administrators and unfamiliar files. October's activity shows how quickly attackers move once a patch is public, so the gap between a fix being released and being applied is where most of the risk sits.

Sources: WordPress 7.1.4, SecurityWeek, The Hacker News, WordPress.org: Critical PHP Security Release