On Wednesday, WordPress released version 7.1.4, a security update that fixes 22 vulnerabilities, including a race condition in the core update process that could allow an unauthenticated attacker to run code on the server.
The fixes are spread across 17 advisories, up from seven in WordPress 7.1.3 three weeks ago. WordPress has not published CVE identifiers or CVSS scores. All but two of the flaws require a logged-in account, usually a Contributor account, which is the lowest role that can write posts.
WordPress 7.0 and 6.9 are affected by all 22 issues. The project has backported the fixes to every branch shipping versions 7.0.8, 6.9.11, 6.8.12, and onward down to 4.7.39. Sites running WordPress 4.6 or older get nothing.
How does the WordPress update RCE work?
The most serious bug was reported by researcher Umut Bayram and sits in the code that installs updates. WordPress unpacks every update package into the wp-content/upgrade/ folder, which the web server exposes like any other directory. Before 7.1.4, the extraction folder was named after the package, so its path was predictable. A cleanup routine also deleted the index.php file, which normally prevents the folder’s contents from being listed.
That left a complete copy of WordPress at a guessable URL for the few seconds it takes to update. The copy includes wp-admin/setup-config.php, the installer, which runs without the site’s configuration file. According to Patchstack, an attacker who acted in time could run the installer against a database they control within the victim’s web root.
Patchstack rated the attack complexity as high and said it would “not call it practical to exploit.” The window still requires no account or user interaction. The vulnerable code dates back to WordPress 2.8, and the window reopens on every update, including automatic background updates.
WordPress 7.1.4 appends 16 random characters to the extraction folder’s name, recreates index.php, and stops deleting it. A second change, not mentioned in the release announcement, prevents wp-config.php from ever being copied out of the working directory.
Security plugins cannot stop this attack. The extracted copy loads WordPress from its own files, so the site’s PHP firewall never runs. Patchstack advises blocking web access to wp-content/upgrade/ at the server level and confirming the directory cannot be listed.
What else does WordPress 7.1.4 fix?
The second bug, which requires no login, was reported by Antonio Lorensius Silaban. It exposed unpublished Customizer changesets, which are draft designs and settings changes, to anonymous visitors. A preview request with no changeset ID returned the most recent unpublished draft without a permission check, revealing its ID and a rendered preview. The patch now requires the customization capability.
Seven advisories cover the Interactivity API, the framework that powers interactive blocks and whose browser runtime arrived in WordPress 6.4. They share one root cause. KSES, the HTML filter for users without the unfiltered_html permission, allows any data-* attribute, and every Interactivity API directive is a data-* attribute. A Contributor could plant directives in a post that passed filtering intact, and the runtime would then act on them for every visitor. The result was stored cross-site scripting (XSS) through javascript: URLs, event-handler bindings and prototype pollution. One variant freezes a visitor’s browser tab rather than the server.
Credited researchers on those bugs include rekter0, Anas cherni, Marcel Karlsson, and AnC and DatNLQ of VietSunshine Cyber Security, alongside members of the WordPress Security Team.
Anthropic, the AI company behind Claude, reported two issues. One is an Editor-level stored XSS on the personal data erasure screen. The other is a hardening fix for unescaped usernames on multisite Network Users screens.
Rafie Muhammad of Awesome Motive found a stored XSS caused by WordPress’s PHP and JavaScript block parsers disagreeing on which characters count as whitespace. A crafted block delimiter looked like a harmless HTML comment to the server but like a real block to the editor. He also reported a stored XSS in Customizer selective refresh.
The remaining fixes cover:
- a format-string XSS in the Categories block
- unescaped labels in the Comments Pagination and Post Navigation Link blocks
- a permissions bug that let custom roles holding the moderate_comments capability read, edit, and delete notes on posts they could not edit
The release also refreshes WordPress’s bundled root certificates following the revocation of eMudhra’s certificates. Chrome revoked trust in the Bengaluru-based certificate authority’s emSign ECC Root CA – G3 on October 27, after eight eMudhra intermediate CAs were found to have generated private keys weakly.
WordPress urges site owners to update immediately via Dashboard → Updates, and sites with background updates enabled will install 7.1.4 automatically. The fixes are also in WordPress 7.2 Beta 3, ahead of the 7.2 release planned for December 8. Neither WordPress nor Patchstack has reported exploitation in the wild.
Patchstack also recommends reviewing which users hold Contributor or higher roles, since that is where all but two of these flaws begin.
Community Discussion
Join the conversation. Ask questions, share solutions, and help others.
Be the first to start the discussion!
