{ "schemaVersion": "guard-threat-campaign/v1", "id": "HGTC-2026-015D685F", "slug": "wordpress-7-1-4-security-release-upgrade-race-rce", "title": "WordPress 7.1.4: a race in the core upgrade process let an unauthenticated visitor reach the unpacked installer mid-update (plus 21 account-required fixes)", "aliases": [ "WordPress 7.1.4", "WordPress 7.1.4 security release", "WordPress upgrade race condition RCE", "wp-content/upgrade race", "WordPress 7.0.8", "WordPress 6.9.11", "WordPress Interactivity API stored XSS", "WordPress Customizer changeset disclosure" ], "summary": "WordPress 7.1.4, released 2026-10-28, fixes 22 vulnerabilities across 17 advisories. The only one that needs no account is a race in the core upgrade process reported by Umut Bayram: during an install or update WordPress unpacks the package into wp-content/upgrade/, a web-served folder. Before 7.1.4 the working folder name was predictable for admin-uploaded packages and the pre-unpack cleanup deleted the folder's index.php, so a visitor who requested the right path during the seconds an update ran could reach the unpacked copy's wp-admin/setup-config.php. The fix (commit e7b33f536d) appends 16 random characters to the folder name, keeps and recreates index.php, and stops update_core() copying a wp-config.php out of the working directory. The window opens on every update, including automatic background updates. The other 21 issues need a logged-in user, mostly Contributor or above: stored XSS in the Interactivity API (seven advisories sharing a KSES data-* root cause), Customizer selective refresh, the Categories, Comments Pagination and Post Navigation Link blocks and block delimiters; Editor+ XSS on the personal data erasure screen; plus an unauthenticated leak of unpublished Customizer changesets and a Notes permission bug for custom roles. HelpHub lists fixed releases for every branch back to 4.7.39.", "status": "published", "severity": "high", "confidence": "high", "uncertainty": "No CVE IDs or GitHub security advisories had been published for this release as of 2026-10-28 18:50 UTC. WordPress does not publish CVSS scores in the release post; Patchstack rates the upgrade race with high attack complexity and calls it impractical to exploit. Packages for 6.5.14 and older branches returned 404 on wordpress.org at 18:50 UTC although HelpHub lists them, and the release post says backports ship as they become ready. No exploitation in the wild has been reported.", "firstObservedAt": "2026-10-28T15:56:16Z", "lastObservedAt": "2026-10-28T18:51:11Z", "publishedAt": "2026-10-28T18:57:02.414Z", "reviewedAt": "2026-10-28T18:56:56.070Z", "expiresAt": "2026-10-28T18:51:11Z", "reviewer": "HOL Guard Security Publishing", "sources": [ { "id": "wp-news", "label": "WordPress 7.1.4 release announcement", "url": "https://wordpress.org/news/2026/10/wordpress-7-1-4/", "sourceType": "vendor_advisory", "observedAt": "2026-10-28T17:13:53Z" }, { "id": "wp-helphub", "label": "WordPress 7.1.4 HelpHub page", "url": "https://wordpress.org/documentation/wordpress-version/version-7-1-4/", "sourceType": "vendor_advisory", "observedAt": "2026-10-28T17:13:53Z" }, { "id": "wp-commit", "label": "wordpress-develop commit e7b33f536d: Upgrade/Install: Improve the handling of the upgrade working directory", "url": "https://github.com/WordPress/wordpress-develop/commit/e7b33f536d", "sourceType": "other_primary", "observedAt": "2026-10-28T14:54:23Z" }, { "id": "patchstack", "label": "Patchstack: WordPress 7.1.4 Security Release", "url": "https://patchstack.com/articles/wordpress-7-1-4-security-release/", "sourceType": "research", "observedAt": "2026-10-28T00:00:00Z" }, { "id": "hol-blog", "label": "HOL: WordPress 7.1.4 closes a no-login takeover window during core updates", "url": "https://hol.org/blog/wordpress-7-1-4-security-release-upgrade-race-rce", "sourceType": "other_primary", "observedAt": "2026-10-28T18:51:11Z" } ], "artifacts": [ { "id": "wordpress-core", "artifactClass": "package", "ecosystem": "other", "name": "WordPress core", "version": "<7.1.4; fixed in 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, backports to 4.7.39", "defanged": false } ], "indicators": [], "timeline": [ { "id": "wordpress-714-tagged", "occurredAt": "2026-10-28T15:56:16Z", "eventType": "vendor_action", "summary": "WordPress 7.1.4 is committed to the 7.1 branch, including the upgrade working directory fix (commit e7b33f536d).", "sourceIds": [ "wp-commit" ] }, { "id": "wordpress-714-announced", "occurredAt": "2026-10-28T17:13:53Z", "eventType": "vendor_action", "summary": "WordPress publishes the 7.1.4 security release announcement and HelpHub page listing 22 vulnerabilities and fixed releases for older branches.", "sourceIds": [ "wp-news", "wp-helphub" ] }, { "id": "hol-blog-published", "occurredAt": "2026-10-28T18:51:11Z", "eventType": "other", "summary": "HOL publishes operator guidance on updating, blocking wp-content/upgrade/ and checking for leftovers.", "sourceIds": [ "hol-blog" ] } ], "coverage": [ { "assertionId": "guard-not-wordpress", "relationship": "not_covered", "limitation": "HOL Guard reviews AI coding agent actions on developer machines. It does not inspect WordPress servers, the core upgrader or web server configuration; the fix is the 7.1.4 update plus a web server deny rule for wp-content/upgrade/." } ], "policies": [], "limitations": [ "Sites deployed by Composer or git with DISALLOW_FILE_MODS set to true never run the in-place upgrader, so the upgrade race does not apply, though they still need the 7.1.4 code for the other fixes", "Servers that already deny web access to wp-content/upgrade/ are not reachable by the upgrade race", "Sites with no Contributor, Author or Editor accounts are out of reach of the account-required XSS issues", "The Notes permission issue matters only with custom roles or post types that grant moderate_comments without edit access", "WordPress 4.6 and older receive no fix" ], "correctionHref": "/guard/security/campaigns/wordpress-7-1-4-security-release-upgrade-race-rce/corrections" }