WordPress 7.1.4 Fixes 22 Flaws, One in the Core Update Process

WordPress released version 7.1.4 on October 28 with fixes for 22 vulnerabilities. One of them sits in the update mechanism itself: a race condition during core updates that could lead to remote code execution. The project recommends updating immediately, and sites with automatic background updates will receive the release on their own.

The same day, WordPress shipped the fixes to every older branch that still receives security updates, from 7.0.8 down to 4.7.39. It is the fourth 7.1 point release in six weeks, and together they have fixed 41 security issues.

A Race Condition in Core Updates

The release post describes the issue as “a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window.” It was reported by Umut Bayram. So far, WordPress has not published a severity rating.

Patchstack’s technical analysis of the release describes the mechanism. During an update, WordPress extracts the package into wp-content/upgrade/. Until 7.1.4, the extraction folder had a predictable name, and a cleanup step removed the index.php file that stops the directory from being listed. For a few seconds during each update, a complete copy of WordPress sat at a guessable path. That copy included wp-admin/setup-config.php, which runs without the site’s configuration, so an attacker who reached it in time could run the installer against a database they control, inside the site’s document root. The attack needs no account, but it only works if wp-content/upgrade/ is reachable over the web and the attacker requests the right path while an update runs. Patchstack rated the attack complexity as high and “would not call it practical to exploit.” Version 7.1.4 adds 16 random characters to the folder name and keeps the index.php file in place.

Nearly Everything Else Needs an Account

Patchstack lists the 22 vulnerabilities as 17 advisories. The largest group of the remaining fixes addresses stored cross-site scripting that requires at least the Contributor role. Much of it sits in the Interactivity API and in the Comments Pagination and Post Navigation Link blocks. One XSS issue in the personal data erasure requests screen requires Editor access, and another, in the Interactivity Router, requires Author access.

An information disclosure issue exposed unpublished Customizer changes to unauthenticated visitors. Another issue let custom roles that moderate comments read, edit and delete notes on posts they cannot edit. The release also includes two hardening changes, an update to the bundled root certificates following the eMudhra revocation, and a denial-of-service fix in Interactivity API bindings. According to Patchstack, that issue hangs the visitor’s browser tab, not the server.

Backports Down to 4.7

Branches older than 6.9 are affected by fewer of the 22 vulnerabilities, according to the release documentation. WordPress 4.6 and earlier no longer receive security updates, and only the latest version is actively supported.

The backports matter for a large share of WordPress sites. As of October 29, 64.4% of the installations counted in WordPress.org’s version statistics run the 7.1 branch. Another 34.6% run branches from 4.7 to 7.0, which receive these fixes only through the backport releases. That group includes the 13.7% on 7.0 and 6.9, the two older branches affected by all 22 vulnerabilities. The remaining 0.95% run versions older than 4.7 that get no fixes at all.

Four Security Releases in Six Weeks

WordPress 7.1 shipped on August 19. The release documentation for each of its point releases lists these security fixes:

As we reported on September 30, the single flaw fixed in 7.1.2 was exploited within hours of that release. The next major version, 7.2, is planned for December 8, and 7.2 Beta 3 already contains all applicable fixes.

Mitigations Beyond the Update

Pantheon made 7.1.4 available on its platform on October 28 and labeled the update “Action required.” Customers apply it themselves from the dashboard or the Terminus command-line tool. The company also “has deployed platform-wide mitigations against external abuse of some of the vulnerabilities fixed in this release,” while stressing that customers still need to update their sites as soon as possible.

For the update flaw, Patchstack recommends a measure at the web server. A PHP firewall running inside WordPress cannot block the attack, because the extracted copy of WordPress loads its own files and the site’s firewall never runs for that request. Patchstack’s advice is to deny web access to wp-content/upgrade/ and to check that the directory cannot be listed. The update window returns with every update, including unattended ones.