A WordPress vulnerability fixed in version 7.1.4 on October 28 is drawing attempts to execute code remotely without a site account, according to Defiant findings reported by SecurityWeek. Exploitation depends on a brief interval during a full Core update and several server conditions. Wordfence has not reported successful compromises.
WordPress 7.1.4 contains the fix, which was also backported to release branches through WordPress 4.7. The report does not identify the individual patched releases for those older branches. No CVE identifier had been assigned at the time of reporting.
The high-severity vulnerability concerns temporary files used during the update process. Defiant describes it as a race condition: attackers must act while installer files are available, before WordPress removes them. On many servers, the directory where an upgrade unpacks its files is reachable from the web, and its predictable location gives attackers a path to probe.
That exposure alone is insufficient. The update must use a full package containing installer files, and the staging tree must permit both public web access and PHP execution. Attackers also need to predict or discover its location and finish the attack before cleanup. The opportunity lasts only seconds while WordPress unpacks the complete Core update. Defiant rates the attack complexity as high despite the absence of an authentication requirement.
According to Defiant, attackers are repeatedly requesting the relevant paths to catch that interval. SecurityWeek quoted the firm as saying its new Wordfence firewall rule registered a first match nine minutes after deployment. Across the first 21 hours, telemetry recorded more than 18,500 requests aimed at staged setup-config.php installer paths. This documents attempts; it does not establish successful code execution.
The repair changes how WordPress handles those temporary files: it makes the staging directory random, introduces an index guard and blocks unsafe promotion of staged configuration data. Version 7.1.4 addresses 22 security defects overall, including XSS flaws, interactivity API issues, unauthenticated information disclosure and an authorization weakness. It also updates bundled root certificates to reflect the recent eMudhra revocation.
