The facts
The official release identifies an upgrade-process vulnerability whose exploitation is limited to the update window. Updating to 7.1.4 fixes the current release branch. [1]
Patchstack’s code analysis describes a difficult race condition requiring the upgrade directory to be web-accessible during a brief update. It does not describe a routinely exploitable flaw. [2]
The release also addresses stored cross-site scripting issues, most of which require privileged accounts. WordPress said fixes for eligible older branches were being backported. [1][2]
The Hacker News reports Wordfence's observation of repeated attempts to catch the narrow update window. No independently established number of successfully compromised sites is provided. [3]
The report describes affected Core versions 4.7 through 7.1.3, with a web-accessible staging area required during a full-package upgrade. WordPress says older eligible branches are receiving backports; only the latest version is actively supported. [1][3]
Still unconfirmed
- The checked material does not establish a successful-compromise total or give a CVE identifier for this specific upgrade-process flaw. Observed attempts do not prove every probe succeeded.
Corrections & updates
Substantive update: Added Wordfence's reported observation of attack attempts after the patch. The earlier absence of established exploitation reporting is now qualified by this new attempt telemetry. Successful production compromise remains unestablished, the narrow prerequisites remain explicit, and the 28 October fix date is preserved.
Sources
References support the numbered facts above. Source checks: 30 Oct 2026, 15:30 UTC.
The official release and Patchstack’s original technical analysis were opened. Patchstack is a separately owned commercial security vendor. Its assessment of the exploit conditions is attributed; the official post still described older-branch backports as in progress. The official release was reread this run. Wordfence telemetry is attributed to the actual 30 October independent report, with the primary-telemetry access gap disclosed.
- WordPress 7.1.4 security release
WordPress.org · Primary source · 28 Oct 2026
- WordPress 7.1.4 security release analysis
Patchstack · Reporting · 28 Oct 2026
- WordPress RCE flaw draws nearly 63,000 attack attempts in just 24 hours
The Hacker News / Ravie Lakshmanan · Reporting · 30 Oct 2026
Actual current report read, quoting Wordfence's telemetry and conditions. Independent of WordPress and Wordfence/Defiant. Original Wordfence pages returned empty 202 responses and public web access failed; their direct text is not claimed read. The 62,969 figure is attributed attempted requests, not unique victims or confirmed compromises.