WordPress 7.1.4 shipped on 28 October with fixes for 22 core issues. One of them lets an unauthenticated attacker run code on the server, and it is the only item in that batch that needs attention this week.
What happened
When WordPress unpacks a full core update, it writes the incoming files to predictable directories under wp-content/upgrade. Some of those files are installer components that can be requested over HTTP directly, without WordPress loading first. In versions 4.7.0 through 7.1.3 that staging area is not adequately protected, so an attacker who catches the window open can drive the temporary installer and get PHP executed on the host.
The window is short. Wordfence says its lab tests saw it last only seconds, which is why the observed traffic is not a single request but repeated polling of the staging paths in the hope of landing inside it. The flaw is tracked as CVE-2026-119977 and rated CVSS 8.1.
Who is affected
Any WordPress site on a core release before the fix, on any branch:
- Core 4.7.0 through 7.1.3 are listed as affected, which covers essentially every long-lived install still in service.
- Sites that reached 7.1.4, or the branch release for their line (4.7.39, 4.9.35, 5.6.23 and the rest of that set), are patched.
- Sites where the update ran but the staging directory is still web-reachable deserve a second look at file permissions.
What to do now
Open Dashboard, then Updates, and read the version number. Do not assume the background update landed.
- Confirm 7.1.4, or the matching branch release, is what the site actually reports.
- If auto-updates are disabled because a plugin broke in the past, update core by hand now and re-test the plugin afterwards.
- Delete any leftover wp-content/upgrade directories and confirm the web server refuses direct requests to them.
- Check web server logs for requests to setup-config.php or install.php under wp-content/upgrade from the last week.
- If the site runs a WAF, make sure it inspects direct PHP requests rather than only requests that reach WordPress.
What this means for South African businesses
Most local SME sites sit on shared or managed hosting where the host applies core updates on its own schedule, and the version in the dashboard can lag the release by weeks without anyone noticing. The realistic exposure is a small business that turned off automatic updates years ago after a plugin conflict, then never returned to it. The attack needs luck with timing, but an attacker polling for days gets many attempts, and a staging directory left web-accessible after a failed update turns a narrow window into a permanent one.
Source: Wordfence analysis of the WordPress 7.1.4 security release.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.