What is known about the flaw?
The issue involves a race condition during WordPress core upgrades. This does not mean every vulnerable site can be taken over at any moment: exploitation depends on the relevant conditions. A CISA KEV listing confirms known exploitation, not that every vulnerable installation has been compromised.
Which version is fixed?
WordPress 7.1.4, released on October 28, 2026, addresses the issue alongside other security fixes. Fixes are also being backported to eligible older branches, but their actual availability should be verified per branch. Do not assume that all older versions are already patched.
Checks site owners should run
- Back up files and databases and verify that recovery works.
- In Dashboard → Updates, inspect the WordPress core version and apply the available security release for your branch.
- Patch plugins and themes too, after checking compatibility.
- Verify that the upgrade completed, that the site works, and review administrator accounts and logs.
- If the site was exposed beforehand, look for unexpected changes; investigate suspected compromise instead of assuming that updating alone resolves it.
Prioritizing known exploited flaws
The CISA KEV catalog distinguishes vulnerabilities with known exploitation from those with only a theoretical risk. Connecting software inventories, versions, advisories, fixes and KEV status helps prioritize practical risk. TechAtelier’s software watch can support version tracking but does not replace a WordPress security review.
Official sources
- WordPress 7.1.4 release
- WordPress version documentation
- Canadian Centre for Cyber Security advisory
- CISA KEV catalog