Wordfence said WordPress 7.1.4 came out on October 28, 2026. WordPress says it fixes 22 security flaws. The worst needs no login. It is a timing flaw in the core update that can let an attacker run code on the server. Wordfence said attackers are already trying it. It counted more than 18,500 requests for temporary installer files in the first 21 hours after its new firewall rule went live.
A full-package update unpacks new files, installer included, into a predictable folder under wp-content/upgrade. On many servers the web can reach that folder. An outsider who requests the installer at the right moment can reach the staged copy. In lab tests the folder stayed open for only seconds, so attackers poll again and again. The fix randomizes the folder name.
For servers that expose that folder, the update is the moment of risk. A reader urged blocking web access to /wp-content/upgrade/ before updating, since attackers watch that moment. Wordfence said blocking works, but it urged quick updates to cover all 22 flaws. It also called the flaw very hard to exploit. It said activity when it posted was low for its customer base and concentrated, under 20,000 requests. Most sites should get the fix through automatic background updates.