On October 28, 2026, WordPress announced the release of version 7.1.4, which rectifies 22 significant security vulnerabilities.
Among these is a particularly alarming issue involving unauthenticated remote code execution within the update process itself.
The security update also accounts for risks related to stored cross-site scripting, data exposure, and deficiencies in access control. WordPress strongly advises all website proprietors to implement this update forthwith.
The official announcement for the release acknowledges the contributions of security researcher Umut Bayram, who reported the critical flaw.
Patchstack has conducted a technical breakdown revealing 22 vulnerabilities across 17 distinct advisories. This discrepancy in advisory entries compared to the total number of flaws elucidates the complexity involved.
This release was orchestrated by the collaborative efforts of Aaron Jorbin and Nik Tsekouras, bolstered by insights from independent researchers and the dedicated WordPress Security Team, all working to fortify both legacy and contemporary features against potential threats.
The most critical flaw pertains to a race condition that necessitates an attacker timing their actions with precise accuracy to exploit a temporary installation.
Remarkably, this vulnerability does not require a WordPress account; however, the attack hinges on a fleeting update window and unrestricted access to the wp-content/upgrade/ directory.
During the update process, WordPress unpacks files into said directory. Historically, the use of predictable folder names and the removal of index.php could inadvertently unveil an unpackaged WordPress installer.
An attacker could exploit this vulnerability during the update phase to leverage a maliciously controlled database, paving the way for unauthorized code execution.
Version 7.1.4 addresses this by introducing a layer of security, appending 16 random characters to temporary folder names, reinstating protections forindex.php and restricting the copying of wp-config.php from working directories.
Patchstack evaluates the likelihood of exploitation as notably challenging, primarily due to the extremely brief window of opportunity.
This situation is distinct from an earlier WordPress Core template resolution vulnerability previously reported by Cybersecuritynews.com.
Stored XSS and Permission Gaps
Several enhancements have been made to the Interactivity API, which underpins various interactive elements on pages.
Malicious actors with Contributor access could previously exploit crafted attributes that bypassed content filtering, potentially triggering perilous browser behaviors.
This update implements safeguards to block harmful bindings, fortify verification checks, and rectify a denial-of-service vulnerability that could render a visitor’s browser tab inoperative.
Moreover, fixes targeting stored XSS encompass crafted block markup, Customizer selective refresh, as well as categories and navigation labels.
Additional hardening has been applied to image and playlist processing. It is noteworthy that stored XSS signifies that harmful script content can remain embedded on a site, executing whenever another user accesses the affected material.
Anthropic has raised concerns regarding issues related to the removal of personal data requests and specially crafted usernames.
Additionally, a separate flaw within the Customizer exposed unpublished changes to visitors lacking accounts.
In response, WordPress has intensified note permissions, preventing users from viewing notes linked to posts they are not authorized to edit.
These modifications continue the pattern established by prior WordPress security enhancements aimed at mitigating analogous vulnerabilities.
Update WordPress and Check Protection
Website administrators can install the latest release via the Dashboard under Updates, selecting Update Now, or alternatively, download WordPress 7.1.4 directly.
Sites configured for automatic background updates should receive this version seamlessly; however, administrators are encouraged to verify the installed version to ensure successful implementation of the update.
The official documentation delineates patched earlier versions, which include 7.0.8, 6.9.11, and releases extending back to 4.7.39.
It is important to note that not all branches contain the full complement of 22 vulnerabilities. The most recent WordPress version is the only one receiving active support, while versions 4.6 and earlier will no longer receive security updates.
In addition to patching, Patchstack recommends blocking web access to wp-content/upgrade/ at the server level, alongside auditing accounts with Contributor privileges or higher.
A WordPress plugin firewall may offer little defense against the extracted installer, as this instance loads independently.
Furthermore, the release updates bundled root certificates in light of the eMudhra revocation. Preparations are also underway for WordPress 7.2, scheduled for release on December 8.
However, website owners should prioritize implementing this security update rather than delay for the forthcoming major version.
Source link: Cybersecuritynews.com.
