# WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release

WordPress Core 4.7-7.1.3 unpacks full-package updates into predictable web-accessible wp-content/upgrade staging paths, letting unauthenticated attackers hit the staged installer during the brief upgrade window and reach PHP code execution.

- Payout: Real-world hack
- Severity: high
- Program: WordPress
- Analysis by: Alex Thomas
- Disclosed: 2026-10-29
- Write-up quality: 6/10
- Original: https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/
- Library page: https://bugbountylibrary.com/r/blog%3Awordfence-com-blog-2026-10-wordpress-7-1-4-security-release-rce
- Tags: area:web domain:oss domain:web impact:rce kind:incident platform:research sev:high tech:php tech:wordpress technique:race-window technique:recon vuln:race-condition vuln:rce

**Target:** WordPress Core update staging directory (wp-content/upgrade) and staged setup-config.php installer
**Root cause:** Full-package core upgrades unpack new files into a predictable, web-accessible directory beneath wp-content/upgrade, including the WordPress installer. The staged copy can be interacted with directly before cleanup, and staged configuration data can be unsafely promoted.
**Steps:**
1. Wait for/trigger a full-package Core update so WordPress unpacks files into the predictable staging directory under `wp-content/upgrade`.
2. Poll the predictable staging path for the staged installer (`setup-config.php`) while the upgrade window is open (seconds in lab conditions).
3. Request the staged installer directly (bypassing WordPress bootstrap) to interact with the staged copy.
4. Progress the installer flow to write/execute PHP, achieving code execution before WordPress cleans up the temporary files.
**How found:** Researcher identified that full-package upgrades stage files at predictable, web-accessible paths under wp-content/upgrade including the installer, and that the staged copy remains reachable during the upgrade window.
**Exploitation:** Unauthenticated attacker repeatedly polls predictable staging paths for the staged setup-config.php installer, catching the brief window during a full-package core upgrade, then interacts with the staged WordPress copy to progress to PHP code execution. Requires public web/PHP access to the staging tree and winning the race before cleanup.
**Insight:** Core/plugin updaters that unpack full packages into web-served directories create a race-window attack surface: check predictable staging paths (wp-content/upgrade, setup-config.php) during update windows, and note that direct PHP requests bypass WordPress bootstrap so only pre-request firewalls (Extended Protection) catch them.