WordPress 7.1.4 Upgrade-Window RCE (Repro Highlights) On Oct 28, 2026, WordPress released 7.1.4, fixing a remote code execution issue during the upgrade window (reported by Umut Bayram, CVE-2026-119977). The issue isn’t in the installer itself, but in the upgrade process: a full core upgrade extracts a complete WordPress copy into wp-content/upgrade/wordpress-/. In 7.1.3, this directory is cleared before extraction (including index.php), and the directory name is derived solely from the package filename. During those few seconds, anyone who can reach the site can access the staged copy’s wp-admin/setup-config.php. Repro highlights: •Complete installation against the attacker’s own MySQL → log into the temporary admin → upload a plugin containing PHP → achieve code execution in the target site’s directory •Local testing showed a natural window of ~2.05s (29 hits out of 221 polls); full chain succeeded with command echo of uid=1000 •The uploaded PHP persists even after the upgrade finishes and the temporary directory is deleted •Shorter path: a single request writes wp-config.php; on a later upgrade to an unpatched version or reinstall, this config is copied to the site root, switching the site to the attacker’s database so the attacker can log into the live admin Exploitation requirements: full-package upgrade + wp-content/upgrade web-accessible and able to execute PHP + target can reach the attacker’s MySQL + requests completed inside the window. Analysts note real-world exploitation is not straightforward. Fix: 7.1.4 adds a 16-character random suffix to the directory name, preserves index.php, and skips copying wp-config.php. Key point: Patching does not make the window disappear immediately. The upgrade from 7.1.3 to 7.1.4 is still performed by the old code and still uses the predictable directory. The fix protects subsequent upgrades. If you can’t upgrade yet: block access and PHP execution for wp-content/upgrade/ at the web server layer. For authorized security research and defense only. Update to 7.1.4 (or the corresponding backport) now. #WordPress #Security #RCE
