WordPress released version 7.1.4 on October 28 that addressed 22 security vulnerabilities in its core software. The update addresses several issues, including a flaw that could allow remote code execution during the upgrade process. It also patches multiple cross-site scripting (XSS) vulnerabilities. WordPress has urged website owners to install the update without delay.
The issues chiefly threaten different parts of the platform, such as the Interactivity API, Customizer, and several content blocks. Some can even expose unpublished changes or let users access information they are not authorized to view. The upgrade-related flaw is particularly concerning because it can allow an attacker to run code on a server during a brief window while WordPress updates its files.
WordPress 7.1.4 Security Release Fixes Remote Code Execution Risk During Updates
Security researcher Umut Bayram found a flaw in how WordPress handles core updates. The problem lies in a race condition that could give an attacker a chance to run code on the server while an update is underway.
The risk comes down to timing. During an update, WordPress temporarily stores files in an upgrade directory. If an attacker reaches the right files before the update process finishes, they could potentially exploit the weakness and run their own code. The issue is patched in version 7.1.4.
Stored Cross-Site Scripting Flaws Impact Multiple Components
WordPress 7.1.4 security release also addresses multiple stored cross-site scripting (XSS) security issues. These flaws affect several components, including the Interactivity API, Customizer, Categories block, Playlist block, and Image block.
Stored XSS vulnerabilities can let malicious scripts stay in website content or application data. Following that, when another user accesses the affected content, those scripts may execute in their browser. This state can expose information or enable unauthorized actions depending on the vulnerability and the user's privileges.
Information Disclosure and Permission Issues Also Fixed
The update resolves several additional security weaknesses apart from code execution and XSS. One flaw could expose unpublished Customizer changesets to unauthenticated visitors, while another involved notes that privileged users could access without permission to edit the associated posts.
WordPress also updated its bundled root certificates following the revocation of an eMudhra root certificate, addressing a certificate trust issue alongside the software's other security fixes.
WordPress recommends updating websites immediately because version 7.1.4 is a security release. Administrators can install it through the WordPress dashboard by navigating to Updates and selecting the Update Now button. Apart from that, they can download the release from the official WordPress website.
Stay updated with the latest technologies and security practices, only with SecureITWorld!
Also Read:
