Image: WordPress.org
Why it mattersEvery site that reviews updates by hand has to apply 7.1.4 today. The upgrade bug lets an attacker run code on the server.
Every WordPress site on the stable branch has a security release to apply today. The headline fault is one an attacker can use with no account. WordPress 7.1.4 is out, led by Aaron Jorbin and Nik Tsekouras. The release notes recommend that sites update immediately. The first fault is a weakness in the upgrade process. It can lead to remote code execution during the upgrade window. Umut Bayram of Picus Security reported it.
The upgrade bug, and why it matters
The release notes call the first fix a weakness in the upgrade process. They say it can lead to remote code execution during the upgrade window. That window is the time while WordPress applies a new version. Code runs there as the web server. A site that has automatic background updates on will start the update on its own. The release post says "the update process will begin automatically" on those sites. The window itself is short. A sent exploit does not have to wait for a human.
The rest of the list
The release fixes several stored cross-site scripting bugs. Rafie Muhammad of Awesome Motive reported two. One is in specially crafted block markup. The other is in Customizer selective refresh. Several researchers each reported a stored XSS in the Interactivity API. The named reporters are VietSunshine Cyber Security, Marcel Karlsson, and four from the WordPress Security Team: Weston Ruter, Jon Surrell, Alex Concha and Luis Herranz. Jon Surrell also reported a stored denial-of-service issue in the same API. Ben Bidner of the WordPress Security Team reported stored XSS in the Categories, Playlist and image blocks. Alex Concha reported a stored XSS in the comments pagination blocks. Ramon of the WordPress Security Team reported a notes access bug. Privileged users could read notes on posts they could not edit. Antonio Lorensius Silaban reported that unpublished customizer changesets could be found by unauthenticated users. The release also bundles a root certificate update after the eMudhra revocation.
Anthropic reports two of the fixes
Two entries in the release notes are credited to Anthropic. One is a stored XSS reached through Privacy Data Removal Requests. The other is a stored XSS triggered by specially crafted user logins. The release notes do not say how the reports were made. No claim about automated scanning stands on this list alone. The pattern is still worth noting. An AI company has entries in the credits of a WordPress security release.
What has to happen
The release post tells sites to update immediately and gives three paths. Download WordPress 7.1.4 from WordPress.org. Open the Dashboard and click Updates. Or let automatic background updates run. Security fixes were backported to all branches eligible to receive them, currently through 4.7. The backports will land as they become ready. WordPress 7.2 Beta 3 is also out with the same fixes.
A site that reviews updates by hand should apply 7.1.4 today. The upgrade-path bug is reachable with no sign-in. The fix landed on the WordPress release blog where attackers also read it. A site on automatic core updates will apply 7.1.4 on its own.
Source
- WordPress 7.1.4, Aaron Jorbin, WordPress.org.
- WordPress Announces Another Security Release: Version 7.1.4, Roger Montti, Search Engine Journal.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
