WordPress 7.1.4 Released with Fixes for RCE, XSS, and DoS Vulnerabilities
WordPress 7.1.4 addresses critical security flaws including remote code execution during upgrades, stored XSS in various blocks and APIs, and a denial-of-service issue.
WordPress has released version 7.1.4, a security-focused update that patches a significant number of vulnerabilities, urging all users to update their sites immediately. The release addresses critical issues such as remote code execution (RCE) that could occur during the upgrade process, multiple stored cross-site scripting (XSS) flaws affecting various blocks and APIs, and a denial-of-service (DoS) vulnerability within the Interactivity API.
The security team has thanked numerous researchers for responsibly disclosing these vulnerabilities, highlighting the collaborative effort to secure the platform. Among the reported issues are an RCE weakness during upgrades identified by Umut Bayram, and several stored XSS vulnerabilities. These include flaws in block markup, privacy data removal requests, the Interactivity API, Customizer selective refresh, Categories block, user logins, and playlist/image blocks. Additionally, specific blocks like core/comments-pagination-next and core/comments-pagination-previous were found to be susceptible to stored XSS.
Beyond the XSS and RCE vulnerabilities, a stored denial-of-service issue in the Interactivity API, reported by Jon Surrell, poses a risk of disrupting service availability. The update also includes fixes for less critical but still important issues, such as the discoverability of unpublished customizer changesets by unauthenticated users and the ability for privileged users to read notes attached to posts they cannot edit. An update to the bundled root certificates was also included due to the eMudhra revocation.
This release is a short-cycle update, with the next major version, 7.2, planned for December 8th. The security fixes included in 7.1.4 have also been backported to older, supported branches of WordPress, including versions up to 4.7, ensuring a broader range of users can benefit from the security enhancements. However, users are reminded that only the most recent WordPress version receives active support.
The vulnerabilities addressed in WordPress 7.1.4 highlight the ongoing challenges in securing widely used content management systems. The variety of issues, from RCE to XSS and DoS, underscores the need for continuous vigilance and prompt patching by website administrators. The Interactivity API, a newer feature, appears to be a particular focus for attackers, with multiple vulnerabilities found within it.
Users can update by visiting their WordPress Dashboard and clicking "Updates" or by downloading the latest version directly from WordPress.org. For those with automatic background updates enabled, the process will begin automatically. The immediate application of this update is crucial to protect websites from potential exploitation of these newly disclosed security weaknesses.
This new release, WordPress 7.1.4, significantly expands upon the previous update by addressing a total of 22 vulnerabilities across 17 advisories. Notably, it patches a critical race condition in the core upgrade process that could lead to unauthenticated remote code execution, a flaw that was not present in the prior release. Additionally, the update rectifies multiple stored XSS flaws within various blocks and the Customizer, though these generally require a Contributor or Editor role to exploit.