WordPress: unauthenticated RCE in the core update process (fixed in 7.1.4)
WordPress 7.1.4 was released on October 28, 2026 with fixes for 22 security vulnerabilities. The most serious is an unauthenticated race condition in the Core update process that can lead to remote code execution. Wordfence reports exploitation attempts after the release.
Checked in Shield: no
Who is affected
The source does not specify affected versions. Sites running WordPress that are not on 7.1.4 should consider themselves potentially exposed.
How to check
In the admin area, open Dashboard → Updates and check your current WordPress version. Confirm it is 7.1.4 and that automatic updates actually applied.
How to fix
A patch is available: update WordPress to version 7.1.4. If it did not install automatically, apply it manually as soon as possible.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
CVE ids, the range of affected versions and technical details are not disclosed yet; source: Wordfence blog.
