Verifying WordPress 7.1.4 Core and Plugin Updates Against the Unauthenticated RCE

WordPress 7.1.4 is reported to fix 22 flaws, including an unauthenticated RCE, but the public record does not name the vulnerable component, affected versions, preconditions, or whether exploitation has been seen. This short walks through the defensive work you can still do: snapshot the database and files, verify core checksums before and after the update, freeze plugin auto-updates, audit plugin status, and treat unknown reachability as reachable. Patch core first, verify it, then update plugins. Full write-up: https://hackyjs.com/posts/verifying-wordpress-714-core-and-plugin-updates-against-the-unauthenticated-rce

Read the post →