Attackers are already trying to exploit the most serious flaw fixed in WordPress 7.1.4. Wordfence reports that exploitation attempts began after the release. We covered the release two days ago.
What Wordfence found
The flaw is a race condition in the WordPress update process. It needs no login and can lead to remote code execution, meaning an attacker running their own code on your server.
Exploiting it takes luck. The attacker must hit a very narrow window while WordPress unpacks a core update. Wordfence says that window lasted only seconds in lab tests. Attackers are polling vulnerable paths repeatedly to catch it.
Wordfence also says WordPress described the release as fixing 22 security vulnerabilities. Our earlier article counted 13, so treat Wordfence’s number as the higher figure reported.
What to do
- Open your Dashboard, then Updates, and confirm you are on 7.1.4 or the matching security release for your branch.
- Do not assume the automatic update worked. Wordfence recommends checking.
- Wordfence Premium, Care, and Response customers got a firewall rule on October 28. Free users get it on November 27.
If your site has not updated, update it now.
End of article