WordPress Releases Security Update Addressing Multiple Vulnerabilities
Security update addresses multiple vulnerabilities in WordPress Core, including a weakness that could lead to remote code execution during the upgrade process
Summary
Security update addresses multiple vulnerabilities in WordPress Core, including a weakness that could lead to remote code execution during the upgrade process
Affected platforms
The following platforms are known to be affected:
Threat details
Exploitation Attempts
Security researchers have observed widespread scanning and attempted exploitation of the remote code execution (RCE) vulnerability addressed in WordPress 7.1.4.
The NHS England National CSOC assesses further exploitation as likely.
Introduction
WordPress has released a security update addressing multiple vulnerabilities in WordPress Core. No CVE identifiers have currently been published for these vulnerabilities.
The vulnerabilities include a weakness in the WordPress upgrade process that could lead to RCE during the upgrade window. The update also addresses multiple stored cross-site scripting (XSS) vulnerabilities, a stored denial-of-service vulnerability, and information disclosure and authorisation issues.
WordPress recommends updating sites immediately. Sites that support automatic background updates will begin the update process automatically.
Remediation advice
Affected organisations are encouraged to review the WordPress 7.1.4 Security Release and apply the relevant update as soon as possible.
Remediation steps
| Type | Step |
|---|---|
| Patch |
Upgrade affected WordPress Core installations to version 7.1.4 or later. Sites can be updated through the WordPress Dashboard by selecting Updates and Update Now. Organisations using automatic background updates are encouraged to confirm that the update has completed successfully. https://wordpress.org/news/2026/10/wordpress-7-1-4/ |
| Action |
Organisations using older WordPress branches are encouraged to apply the latest security update available for their branch and migrate to the latest supported version. WordPress states that only its latest version is actively supported. https://wordpress.org/news/2026/10/wordpress-7-1-4/ |
Definitive source of threat updates
Last edited: 30 October 2026 12:07 pm