Barsec Cyber Intel
WordPress 7.1.4 Fixes a Dangerous Update-Window Flaw Attackers Are Already Probing
The security release fixes 22 issues. The most serious can let an attacker run code during a brief window while WordPress Core is updating.
What happened
WordPress 7.1.4 is not just a routine update. It fixes 22 security issues, including one that can let an attacker run code on the server during a very short window while WordPress Core is being updated. The attack does not require a WordPress account. During a full Core update, WordPress temporarily stages a new copy of its files in a predictable location. On vulnerable versions, an attacker who reaches that temporary installer at exactly the right moment may be able to take control of the server. That window is only a few seconds, but attackers are automating the process. Wordfence reported more than 18,500 requests aimed at the vulnerable staging paths during the first 21 hours after its firewall rule was released.
Why this matters
Most small businesses will never watch the WordPress update process closely enough to spot this kind of attack. Many sites update automatically, which is convenient, but owners may assume they are protected without verifying the update completed. The flaw is harder to exploit than many WordPress issues because an attacker must catch the brief update window. Automated scanners can keep trying until they get lucky. The right response is simple: verify the site is actually on a patched WordPress release.
What you should do
- In WordPress, go to Dashboard → Updates and confirm the site is on WordPress 7.1.4 or the corresponding patched release for its branch.
- Do not assume automatic updates completed successfully; verify the installed version.
- If you use Wordfence, confirm the firewall is enabled and optimized. A firewall helps but does not replace the Core update.
- If the site remained unpatched while exploit attempts were underway, review for unexpected administrator accounts, unfamiliar plugins, unknown PHP files and suspicious requests beneath wp-content/upgrade. Run a malware/security scan after updating.
- If you are on an unsupported WordPress branch, plan an upgrade to a supported release.