WordPress Core Update Remote Code Execution Vulnerability (CVE-Unknown)

A serious vulnerability has been identified in WordPress Core. The vulnerability is caused by a race condition during the core update process and could allow an unauthenticated remote attacker to execute arbitrary code on the affected server. During a core update, WordPress extracts files to a temporary directory under wp-content/upgrade/. An attacker who accesses the temporary installation during the update window could potentially execute arbitrary PHP code. Successful exploitation could result in full compromise of the affected website.

WordPress has released security updates to address the vulnerability. System owners are strongly recommended to verify their installed WordPress version and update to the latest patched version immediately.

Vulnerability

• WordPress Core Update Remote Code Execution Vulnerability (CVE-Unknown)

Severity Level

• High

Affected Versions

• WordPress Core versions prior to 7.1.4

Remediation

• Update WordPress Core immediately:
  • WordPress 7.1: Upgrade affected installations to WordPress 7.1.4 or later
  • WordPress 7.0: Upgrade to 7.0.8 and plan migration to the actively maintained release.
  • WordPress 6.9: Upgrade to 6.9.11 and plan migration to the actively maintained release.
  • Other legacy branches: Apply the corresponding branch-specific security release listed in the official release archive, down to 4.7.39.
  • WordPress 4.6 and earlier: Migrate to a supported version as security updates are no longer available.
• Verify automatic updates.
• Monitor for suspicious activities.
• Perform a post-update security review.
• Back up the website before updating.

Reference

• WordPress: 7.1.4
• patchstack: WordPress 7.1.4 Security Release
• Wordfence: WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release

Published on: 30 Oct 2026