WordPress 7.1.4 fixes remote code execution flaw
The race condition affects the update process itself; fixes were also issued for the 7.0.8, 6.9.11 and 6.8.12 branches.
WordPress released security update 7.1.4 on October 28, 2026, addressing a remote code execution vulnerability in the content management system.
According to dailysecu.com, the flaw can be triggered during the WordPress update process through a race condition involving temporarily created files. Security researcher Umut Bayram discovered and reported the vulnerability.
Alongside 7.1.4, security fixes were released for older branches, including versions 7.0.8, 6.9.11 and 6.8.12. WordPress states that it actively supports only the latest version.
Attempts to exploit the flaw
In the 24 hours after the vulnerability was disclosed, Wordfence reported 62,969 blocked attack attempts.
Quick answers
What does WordPress 7.1.4 fix?
It fixes a remote code execution vulnerability that can be triggered during the update process through a race condition involving temporarily created files.
Who reported the vulnerability?
Security researcher Umut Bayram discovered and reported it.
Were older WordPress versions patched?
Yes, security fixes were released for versions 7.0.8, 6.9.11 and 6.8.12.