WordPress patches a serious hole, and attackers started knocking within hours

Key points

• WordPress 7.1.4, released this month, fixes a remote code execution flaw in the upgrade process itself, meaning attackers can hijack a site during the moments it is updating; the bug was reported by researcher Umut Bayram and affects versions 4.7 through 7.1.3.
• The advisory also credits Anthropic, the AI company, for finding a stored cross-site scripting bug in Privacy Data Removal Requests, which is a first for the WordPress security credits.
• One security firm logged close to 63,000 exploit attempts against the flaw in the first 24 hours after the patch went out, according to reporting by The Hacker News.
• The flaw has no CVE identifier assigned yet but carries a severity score of 8.1 out of 10.
• Sites without automatic updates enabled are the exposed population right now; every hour unpatched is an hour on the target list.

WordPress shipped an emergency update, version 7.1.4, to close a serious hole in the way the software updates itself. Within a day, attackers were already trying it in the wild.

The bug sits in the upgrade process. When a WordPress site pulls down a new version of its own software, there's a short window where an attacker who can reach the right endpoint can slip in their own code and get the server to run it. That's called remote code execution, and it's about as bad as web bugs get. Researcher Umut Bayram reported it.

Sites that run automatic background updates get the fix without anyone touching them. Everyone else has to log in to the dashboard and click Update Now. That gap is where this plays out over the next few weeks.

What is actually broken?

The flaw lives in WordPress Core, not a plugin, and it covers versions 4.7 all the way through 7.1.3: roughly nine years of releases. There's no CVE number yet, which is unusual for something scored 8.1 out of 10, but the WordPress security team has published the fix and credited the reporter. We covered a nearly identical race between patch and attacker when 7.1.2 shipped on 24 September; this is becoming a pattern worth watching.

The 7.1.4 release also cleans up several stored cross-site scripting bugs, which are flaws that let an attacker plant malicious code inside a page so it runs in a visitor's browser later. One was reported by Rafie Muhammad at Awesome Motive. Another, in the Privacy Data Removal Requests feature, was reported by Anthropic, the company behind the Claude AI assistant. An AI lab showing up in the WordPress security credits is new.

Should site owners be worried?

Yes, if you run WordPress with automatic updates off. The failure mode is the classic one: a patch drops, the technical write-up gets reverse-engineered within hours, anything still on an old version becomes target practice. One security vendor told The Hacker News it saw nearly 63,000 exploit attempts in the first 24 hours.

For ordinary readers who just visit WordPress sites, there's nothing to do. The risk falls on the site operator, though a hijacked site can serve malware or phishing pages later. If a small-business or community site you use starts behaving oddly in the coming weeks, it's worth a note to whoever runs it.

What should operators actually do today?

Update to 7.1.4. If you manage WordPress for a client or an employer and you've been sitting on auto-updates-off because a plugin broke in 2022, this is the week to revisit that call. The sites that get hit in these waves are almost always the ones where someone meant to patch and never got round to it.

The bluntest way to put it: the upgrade process is now part of your attack surface, not your remediation plan.