WordPress News: Critical Core Patch and a Hidden Server Bug (Week of 3 November 2026)

This week's news is a reminder that WordPress security comes in two flavours: the kind you fix by clicking "update now," and the kind that lives further down the stack, in the server software nobody thinks about until it breaks. Both showed up in the last few days, and both are worth five minutes of your time.

Update WordPress now, this one's already being probed

WordPress 7.1.4 landed on 28 October 2026 as a security release, patching 22 issues across Core. The most serious is an unauthenticated race condition in the update process itself: during the brief window while a full Core update is unpacking, an attacker who times a request perfectly can reach a staged installer file and work toward remote code execution. Wordfence reported that threat actors began probing for this within hours of the release, logging over 18,500 requests in the first 21 hours. Patchstack's write-up confirms the same picture.

To be fair to WordPress, the attack window is genuinely tiny, a matter of seconds, so this isn't a "panic now" situation. It's closer to trying to hit a target the size of a womp rat from a moving ship: possible, but it takes a lot of attempts. The fix in 7.1.4 randomises the staging path and closes the gap for good.

What this means for you: check Dashboard > Updates and confirm your site shows WordPress 7.1.4 (or the matching security release for your branch; WordPress backported the fix all the way to 4.7). Most sites update automatically, but "probably updated" isn't the same as "confirmed updated." If you're not sure how to check, that's exactly the kind of thing covered in our guide to WordPress security best practices. If an update ever leaves your site in a broken state, our critical error guide walks through the recovery steps.

A server-level bug could knock your site offline, and no plugin update fixes it

The second story is less familiar territory, because the vulnerable code isn't in WordPress at all. Patchstack documented a flaw in Google's Brotli compression library (CVE-2026-111497, CVSS 9.2) that WordPress can trigger without meaning to. Here's the chain: an attacker sends a pingback request to your site pointing at a server they control; WordPress fetches that URL as part of normal pingback handling; the attacker's server replies with a corrupted, Brotli-compressed response; and the server-level library that unpacks it writes past the end of its buffer. In the clearest documented cases so far, that crashes the PHP worker handling the request. Enough of those requests in a row and your site effectively goes down.

Details are still emerging on how far this can be pushed. Researchers have working proof-of-concept crashes, and some chains against other software (not WordPress specifically) have gone further, but nobody has published working code execution against a typical WordPress host yet. The honest read is: this is a real denial-of-service risk today, and a "watch this space" risk for anything worse.

What this means for you: this isn't something you patch inside WordPress, because the vulnerable piece is the underlying server software your host runs. If you manage your own server, the practical fix is updating the Brotli library package and, as a stopgap, disabling XML-RPC pingbacks (most decent security plugins and hardening guides include a toggle for this). If your hosting or maintenance provider handles your server stack, this is squarely their job: confirm with them that it's being tracked. This is a good moment to mention that a maintenance plan exists precisely so you don't have to personally track CVE numbers in compression libraries; someone else watches for this and handles it quietly.

The takeaway

Neither story calls for panic, but both call for action from someone, you or whoever manages your site. Confirm your Core version is current, and ask your host or developer whether server-level packages like Brotli get patched as a matter of course. If the answer to either question is a shrug, that's the actual problem to fix this week, not the CVE itself.

May the Code Be With You.