WordPress 7.1.4 fixes a bug under attack, plus a Brotli server flaw

WordPress 7.1.4 came out on Wednesday with 22 security fixes, and attackers started trying one of them within hours. Most sites will have updated themselves, but it only takes a couple of minutes to check every site you look after is on 7.1.4.

It was another week where the server mattered as much as WordPress. A bug in Brotli, a compression library that sits on your hosting server, can be used to knock WordPress sites offline, and only your host can fix it. Meanwhile Avada and Essential Addons for Elementor both fixed bugs that could hand a stranger far too much access.

WordPress 7.1.4 fixes 22 security bugs

Attackers are trying the one that needs no login

When WordPress installs a full update, it unpacks a complete copy of the new version into a folder inside wp-content/upgrade for a few seconds. Until 7.1.4 that folder had a predictable name and included the WordPress installer. If someone requested the installer at just the right moment, they could get as far as running their own code on your server, without logging in.¹

The timing is very hard to hit, and Patchstack wouldn't call it practical.² Attackers are trying anyway. Wordfence saw its first blocked attempt nine minutes after it released a firewall rule, and more than 18,500 requests in the first 21 hours. Two sources kept checking the same small groups of sites for about 14 and a half hours, hoping to catch an update in progress.¹

The fix gives the folder a random name and stops it being browsable. It went into 7.1.4 and into security releases for every older version back to 4.7, such as 7.0.8 and 6.9.11.³² If you use the free version of Wordfence, its firewall rule doesn't reach you until 27 November, so updating is what protects you.¹

Most of the rest need an account on your site

The other fixes mostly need someone to already have an account, usually at Contributor level or above. They include several ways a Contributor could sneak harmful code into a post that then runs for an editor or admin. One more needed no login at all: anyone could see unpublished changes waiting in the Customizer.³² If you've got old Contributor or Author accounts you don't use, this is a good week to remove them.

Seven security releases since July

This was the fourth WordPress security release in 41 days, and the seventh since mid-July. The security team says WordPress used to get 20 to 30 bug reports a month through its bug bounty programme. In July it got 450, and in August 773. It has had more than 3,000 this year, more than the previous twelve years put together.⁴

A lot of that is researchers using AI tools to find bugs faster, and two of this week's fixes were credited to Anthropic. The team is now automating most of the release process and using its own AI tools to triage reports and hunt for bugs before anyone else does.⁴ I think frequent security releases are the new normal, which is fine as long as automatic updates are switched on. If you've turned them off, I'd turn them back on for security releases at least.

Your host has another fix to install: Brotli

What it means for a WordPress site

Brotli is a compression library made by Google that's installed on most web servers. A bug in it was fixed on 21 October, and this week the US cybersecurity agency CISA added it to its list of bugs known to be used in real attacks.⁵⁶

WordPress doesn't include Brotli, but whenever your site fetches something from another website (a pingback, an embed, a feed or a plugin looking something up), the server can unpack the reply using its own copy. Patchstack explains that one booby-trapped pingback, sent without logging in, can crash the process serving your site, and enough of them can keep it down. Nobody has published a way to turn this into a break-in on a WordPress server yet, so the real risk right now is your site being knocked offline.⁵

There's nothing to update in WordPress. Your host needs to update Brotli on the server, so ask them: "Has the server's Brotli library been patched for the October 2026 fix?" Don't rely on the version number, because Debian and Ubuntu add the fix without changing it.⁵ Blocking xmlrpc.php at the server closes the easiest route but not every route (check nothing you use relies on it first, such as Jetpack), and the usual "disable XML-RPC" plugin setting doesn't stop pingbacks at all.⁵

PHP2Shell: still no confirmed WordPress break-ins

On Monday CISA also added last week's two PHP2Shell bugs to its list of exploited vulnerabilities.⁶ Outside WordPress there have been reported break-ins, including on firewalls and a Windows server. Wordfence logged about 77,600 attack attempts against WordPress sites between 23 and 27 October, but as of Wednesday it hadn't seen a single confirmed WordPress compromise.⁷ If you didn't get a straight answer from your host last week about whether PHP is patched, chase it up.

WordPress news

WordPress 7.2 beta 2 and beta 3

WordPress 7.2 beta 2 came out on Tuesday, mostly with work developers will care about, and beta 3 followed on Wednesday with the 7.1.4 security fixes included.⁸³ The final release is still due on 8 December. Test it on a staging copy, not your live site.

A plan to let AI assistants sign in to WordPress

WordPress's AI team has set out how it wants AI assistants to work with WordPress 7.3. The idea is that you tell your assistant which site you want help with, it sends you a link, you sign in and approve it, and that's it. Getting there means building in the connection system assistants use, plus a basic set of things an assistant can do on a site. It also needs a proper sign-in, so nobody has to paste an application password into a chat. The team is clear that it only goes into 7.3 if it's ready and passes security review.⁹

A proper sign-in would be a big improvement on pasting passwords about. But it opens a new way into your site, so I'm glad the security review is part of the plan.

For developers

Gutenberg 24.3 lets you apply formatting like bold or italic across several blocks at once.¹⁰ And 7.1.4 updated WordPress's bundled list of trusted root certificates after one certificate authority's certificates were withdrawn.³

WooCommerce

WooCommerce 11.3 is due the week of 9 November

There was no WooCommerce release this week, but the 11.3 beta is out and the final version is due the week of 9 November. The On-Sale Badge block can now show the amount or percentage a customer saves, or "Up to 50%" on variable products. You can also pick your refunds and returns policy page under WooCommerce › Settings › Advanced › Page setup, and WooCommerce tells search engines where it is. Product blocks get more colour, spacing and border settings too.¹¹

As I mentioned last week, 11.3 also removes WooCommerce's old AI assistant connection, so if you use it, switch to the WordPress MCP Adapter plugin before you update.¹¹

Plugin security updates

I haven't seen reports of attacks on any of these, but if you use them, update:¹²

Avada is a premium theme, so its update comes through Avada rather than WordPress.org. Version 7.16.4 came out on Tuesday, and Avada says it fixes a possible way to run code through Avada Forms upload fields.¹³ Rank Math's fix actually came out in August and Gravity Forms' on 1 October, but the details were only published this week, so most sites will have them already.¹²¹⁴

Menu Cart for WooCommerce 3.2.1 stops shoppers slipping code into the cart slide-out, and NextGEN Gallery 4.5.5 is a security hardening release worth installing. LiteSpeed Cache 7.9.2, which I recommended last week, turned out to fix two more bugs too.¹² If you're not sure how to handle any of this, see my guide to dealing with a plugin security vulnerability.

For the long tail, Wordfence's report for 19 to 25 October counted 268 new vulnerabilities across 182 plugins and 15 themes.¹⁵

What I'd do this week

• Check every site is on WordPress 7.1.4 under Dashboard › Updates, or the security release for its version. If an update leaves a site showing a maintenance message, here's how to get WordPress out of maintenance mode.
• Ask your host whether Brotli is patched, and whether PHP is patched for PHP2Shell if you haven't had a clear answer yet.
• Update Avada, Essential Addons for Elementor, AI Engine and Jupiter X Core if you use them, then the rest of the table.
• Remove user accounts you don't need, especially old Contributor and Author logins, since most of this week's bugs start with one.
• Make sure you have a recent backup you can restore. If an update breaks something, here's how to fix a site after a bad update.