On October 28, 2026, WordPress released version 7.1.4, a security update that it recommends installing immediately. The most serious fix closes a weakness in the WordPress update process that can lead to an attacker running their own code on the web server while an update is being installed. No password is needed.
Many small and mid-size businesses run their website on WordPress, often on a hosting plan nobody has looked at in a while. Within days of the release, the security company Wordfence reported that attackers were already trying to exploit this flaw.
The short version: confirm your site is on WordPress 7.1.4 (or the latest security release for its older branch), then take a quick look for administrator accounts, plugins or files you do not recognize.
What is happening
According to Wordfence, WordPress versions 4.7 through 7.1.3 unpack a full update into a predictable folder under wp-content/upgrade, and that temporary copy includes the WordPress installer. On many servers that folder can be reached from the web. An attacker who requests the installer at exactly the right moment can use it to get code running on the server.
The window is short, often only seconds. But Wordfence says attackers are repeatedly polling sites in an attempt to catch an update in progress, and it reported blocking 62,969 attack attempts against this flaw in 24 hours. Wordfence rates the flaw 8.1 out of 10. It does not have a CVE number yet.
The same release also fixes a number of smaller issues, mostly ways to plant harmful script in pages through specially crafted content.
Who is at risk
Any WordPress site running version 4.7 through 7.1.3. Sites with automatic background updates should have updated on their own, but it is worth confirming, especially on older sites, sites where updates were turned off, and sites managed by a former web designer.
What to do this week
- Check the version. Sign in to the WordPress dashboard and open Updates. It should show 7.1.4 or later. If not, click Update Now. WordPress has backported the fixes to older branches back to 4.7, so a site on an older branch should install the latest security release for that branch, and plan a move to the current version.
- Confirm automatic updates are on and that someone gets the update emails WordPress sends.
- Look for warning signs. Wordfence suggests checking for requests to PHP files under wp-content/upgrade in your web logs, and for administrator accounts, plugins or PHP files you do not recognize.
- If something looks wrong, change the WordPress and hosting passwords, remove unknown accounts and get help cleaning the site before putting it back in service.
Questions to ask your web or IT provider
- What WordPress version is our site on, and are automatic updates turned on?
- Who is responsible for updating the site and its plugins?
- Do we have a recent backup of the site that we could restore from?
Not sure what version your company website runs, who updates it, or whether anything was changed? We can check your WordPress site, confirm the update and look for warning signs. Call 713.980.2000 or send us a note.
Let's Talk →