WordPress Core flaw lets unauthenticated attackers run code during updates

Site owners on any release from 4.7 through 7.1.3 should update to 7.1.4, since attackers began probing the flaw within hours of its disclosure.

A high-severity WordPress Core flaw, patched October 28 in version 7.1.4, lets unauthenticated attackers run code on a server during a full-package update by racing a predictable, web-reachable staging directory. Affected releases span 4.7 through 7.1.3, and the flaw carries a CVSS score of 8.1 but no CVE identifier yet. Wordfence reports attackers began polling the vulnerable paths within hours, logging 62,969 blocked attacks over 24 hours, with two sources polling small groups of sites for about 14.5 hours. The fix randomizes the staging directory, adds an index guard, and blocks unsafe promotion of staged configuration data, with backports reaching branches back to 4.7. Site owners are urged to update to 7.1.4 and check for requests to PHP files under wp-content/upgrade as well as unfamiliar administrator accounts or plugins.