high severityConfidence highHistorical record

WordPress 7.1.4: a race in the core upgrade process let an unauthenticated visitor reach the unpacked installer mid-update (plus 21 account-required fixes)

Direct answer

WordPress 7.1.4: a race in the core upgrade process let an unauthenticated visitor reach the unpacked installer mid-update (plus 21 account-required fixes), also tracked as WordPress 7.1.4 / WordPress 7.1.4 security release / WordPress upgrade race condition RCE is a high-severity threat campaign HOL Guard tracked from Oct 28, 2026 to Oct 28, 2026, verified against 5 primary sources and last reviewed Oct 28, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

WordPress 7.1.4, released 2026-10-28, fixes 22 vulnerabilities across 17 advisories. The only one that needs no account is a race in the core upgrade process reported by Umut Bayram: during an install or update WordPress unpacks the package into wp-content/upgrade/, a web-served folder. Before 7.1.4 the working folder name was predictable for admin-uploaded packages and the pre-unpack cleanup deleted the folder's index.php, so a visitor who requested the right path during the seconds an update ran could reach the unpacked copy's wp-admin/setup-config.php. The fix (commit e7b33f536d) appends 16 random characters to the folder name, keeps and recreates index.php, and stops update_core() copying a wp-config.php out of the working directory. The window opens on every update, including automatic background updates. The other 21 issues need a logged-in user, mostly Contributor or above: stored XSS in the Interactivity API (seven advisories sharing a KSES data-* root cause), Customizer selective refresh, the Categories, Comments Pagination and Post Navigation Link blocks and block delimiters; Editor+ XSS on the personal data erasure screen; plus an unauthenticated leak of unpublished Customizer changesets and a Notes permission bug for custom roles. HelpHub lists fixed releases for every branch back to 4.7.39.

Also tracked as WordPress 7.1.4 · WordPress 7.1.4 security release · WordPress upgrade race condition RCE · wp-content/upgrade race · WordPress 7.0.8 · WordPress 6.9.11 · WordPress Interactivity API stored XSS · WordPress Customizer changeset disclosure

First observed
Oct 28, 2026
Last observed
Oct 28, 2026
Last reviewed
Oct 28, 2026
Tracking ended
Oct 28, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

No CVE IDs or GitHub security advisories had been published for this release as of 2026-10-28 18:50 UTC. WordPress does not publish CVSS scores in the release post; Patchstack rates the upgrade race with high attack complexity and calls it impractical to exploit. Packages for 6.5.14 and older branches returned 404 on wordpress.org at 18:50 UTC although HelpHub lists them, and the release post says backports ship as they become ready. No exploitation in the wild has been reported.

  • Sites deployed by Composer or git with DISALLOW_FILE_MODS set to true never run the in-place upgrader, so the upgrade race does not apply, though they still need the 7.1.4 code for the other fixes
  • Servers that already deny web access to wp-content/upgrade/ are not reachable by the upgrade race
  • Sites with no Contributor, Author or Editor accounts are out of reach of the account-required XSS issues
  • The Notes permission issue matters only with custom roles or post types that grant moderate_comments without edit access
  • WordPress 4.6 and older receive no fix

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard reviews AI coding agent actions on developer machines. It does not inspect WordPress servers, the core upgrader or web server configuration; the fix is the 7.1.4 update plus a web server deny rule for wp-content/upgrade/.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Vendor action

    WordPress 7.1.4 is committed to the 7.1 branch, including the upgrade working directory fix (commit e7b33f536d).

    Source:wordpress-develop commit e7b33f536d: Upgrade/Install: Improve the handling of the upgrade working directory

  2. Vendor action

    WordPress publishes the 7.1.4 security release announcement and HelpHub page listing 22 vulnerabilities and fixed releases for older branches.

    Sources:WordPress 7.1.4 release announcement·WordPress 7.1.4 HelpHub page

  3. Update

    HOL publishes operator guidance on updating, blocking wp-content/upgrade/ and checking for leftovers.

    Source:HOL: WordPress 7.1.4 closes a no-login takeover window during core updates

Publication clock: 0.1 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • WordPress core@<7.1.4; fixed in 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, backports to 4.7.39otherpackage

Sources

Every claim on this record is traceable to the sources below.

Campaign questions, answered

WordPress 4, released 2026-10-28, fixes 22 vulnerabilities across 17 advisories. HOL Guard tracked the campaign from Oct 28, 2026 to Oct 28, 2026.

No. Active tracking ended Oct 28, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 5 primary sources, names 1 reviewed artifact, and was last fully reviewed Oct 28, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. No CVE IDs or GitHub security advisories had been published for this release as of 2026-10-28 18:50 UTC.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-015D685F