{"type":"bundle","id":"bundle--b6ab3fb5-efdf-5006-81ff-5df82b5db1f2","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--1db1278b-3da9-59b2-b990-bbceca03dfc6","created":"2026-10-28T18:57:02.414Z","modified":"2026-10-28T18:57:02.414Z","name":"WordPress 7.1.4: a race in the core upgrade process let an unauthenticated visitor reach the unpacked installer mid-update (plus 21 account-required fixes)","description":"WordPress 7.1.4, released 2026-10-28, fixes 22 vulnerabilities across 17 advisories. The only one that needs no account is a race in the core upgrade process reported by Umut Bayram: during an install or update WordPress unpacks the package into wp-content/upgrade/, a web-served folder. Before 7.1.4 the working folder name was predictable for admin-uploaded packages and the pre-unpack cleanup deleted the folder's index.php, so a visitor who requested the right path during the seconds an update ran could reach the unpacked copy's wp-admin/setup-config.php. The fix (commit e7b33f536d) appends 16 random characters to the folder name, keeps and recreates index.php, and stops update_core() copying a wp-config.php out of the working directory. The window opens on every update, including automatic background updates. The other 21 issues need a logged-in user, mostly Contributor or above: stored XSS in the Interactivity API (seven advisories sharing a KSES data-* root cause), Customizer selective refresh, the Categories, Comments Pagination and Post Navigation Link blocks and block delimiters; Editor+ XSS on the personal data erasure screen; plus an unauthenticated leak of unpublished Customizer changesets and a Notes permission bug for custom roles. HelpHub lists fixed releases for every branch back to 4.7.39.","aliases":["WordPress 7.1.4","WordPress 7.1.4 security release","WordPress upgrade race condition RCE","wp-content/upgrade race","WordPress 7.0.8","WordPress 6.9.11","WordPress Interactivity API stored XSS","WordPress Customizer changeset disclosure"],"first_seen":"2026-10-28T15:56:16Z","last_seen":"2026-10-28T18:51:11Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"WordPress 7.1.4 release announcement","url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/"},{"source_name":"WordPress 7.1.4 HelpHub page","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},{"source_name":"wordpress-develop commit e7b33f536d: Upgrade/Install: Improve the handling of the upgrade working directory","url":"https://github.com/WordPress/wordpress-develop/commit/e7b33f536d"},{"source_name":"Patchstack: WordPress 7.1.4 Security Release","url":"https://patchstack.com/articles/wordpress-7-1-4-security-release/"},{"source_name":"HOL: WordPress 7.1.4 closes a no-login takeover window during core updates","url":"https://hol.org/blog/wordpress-7-1-4-security-release-upgrade-race-rce"}]}]}