WordPress 7.1.4 Security Update Fixes Code Execution Flaw in the Update Process

On October 28, WordPress released version 7.1.4 and urged site owners to update without delay. Among other things, the release fixes a weakness in the update process that could allow remote code execution while an update is running. SecNews has also reported on the fixes.

What was fixed

The release also addresses vulnerabilities that let attackers store malicious scripts in various parts of the system. These flaws are known as stored XSS. They can cause a script to run in the browser of anyone who opens the crafted content.

The announcement also lists privacy and access control issues. It gives no CVE numbers for the individual bugs and says nothing about whether any of them are being actively exploited. A patch being released does not, on its own, mean that a given site has already been compromised.

Which sites need checking

Site owners should check which version is actually installed. Sites that support automatic updates may start the update on their own, but you should still confirm that it finished.

The WordPress team is also preparing fixes for older branches and notes that these are being rolled out gradually. It also reminds users that only the latest version is actively supported. If you run an older installation, check whether a fixed release is available for your branch and plan how the site will be maintained going forward.

Your review should include corporate websites, online stores, campaign sites and any lower-profile installations your organization still looks after.

What to do now

• Check the WordPress version in the admin dashboard and confirm who is responsible for updating it.
• Back up your files and database, and make sure you know how to restore them.
• Install 7.1.4, or check whether a fix is available for the older branch you use.
• After updating, test logins, forms and the site’s key features.
• Clean up editorial accounts and remove permissions that are no longer needed. Reviewing accounts adds to the update but does not replace it.

SecurHUB’s take

Securing a website requires a clear division of responsibility between the site owner, the administrator and the hosting provider. A web application security audit can help assess how well your site is maintained and identify areas that need closer review.

Sources: WordPress, SecNews