Remote Code Execution Flaw in the Core Update Process
The most serious fix targets a race condition in the core upgrade process, reported by researcher Umut Bayram. During an update, WordPress extracts files into the wp-content/upgrade/ directory. Predictable folder names, combined with cleanup that removed the index.php file, could leave an unpacked WordPress installer reachable from the web. An attacker who reached it at the right moment could run the setup routine against a database they control, opening a path to remote code execution and full site takeover.
No WordPress account is needed, but the attack depends on a window of only a few seconds, so Patchstack rates real-world exploitation as difficult. Version 7.1.4 adds 16 random characters to temporary folder names, restores the index.php protection, and stops wp-config.php from being copied from the working directory.
Stored XSS Fixes Across the Interactivity API, Blocks, and Customizer
A large share of the remaining fixes concern stored cross-site scripting. Several affect the Interactivity API, where users with Contributor access could save crafted attributes that passed content filtering but later triggered unsafe actions in the browser. The update blocks dangerous bindings, tightens checks, and fixes a denial-of-service issue that could freeze a visitor’s browser tab. Other XSS fixes cover crafted block markup, Customizer selective refresh, the Categories block, and navigation labels, while Image and Playlist processing has also been hardened.
Almost all of these flaws require Contributor-level access or higher, so the risk is lower on sites with tightly controlled user roles. The update race condition is the exception, since it can be reached without logging in.
Information Exposure and Permission Fixes
The release also fixes information exposure and permission problems. Unpublished Customizer changesets could be viewed by visitors without an account, and note permissions were tightened so users can no longer read notes attached to posts they cannot edit. Anthropic reported issues involving personal data removal requests and specially crafted usernames. Bundled root certificates were also updated following the eMudhra revocation.
Older WordPress Versions Are Affected Too
Some of the flaws are long-standing. Search Engine Journal notes that certain issues date back to WordPress 4.7, so older branches receive patches too, including 7.0.8, 6.9.11, and releases extending to 4.7.39. Not every branch contains all 22 flaws. Only the latest version gets full support, but WordPress backported these fixes to older branches back to 4.7. Versions 4.6 and earlier get no security updates.
How to Update and Protect Your Site
Site owners can update from the Dashboard under Updates, or download the release from WordPress.org. Automatic background updates should deliver it, but administrators should confirm the installed version rather than assume it worked. Patchstack also recommends blocking web access to wp-content/upgrade/ the server level and reviewing accounts with Contributor privileges or higher. If you’re not comfortable changing server rules yourself, a server management company can apply this restriction for you. A plugin-based firewall may not protect the extracted installer, since that copy loads independently. WordPress 7.2 is scheduled for December 8, but this update should not wait for it. If you don’t have time to track every security release, a WordPress maintenance and support company can handle patching, monitoring, and user-role reviews for you.
