In short
On 28 October 2026, WordPress released security version 7.1.4, which fixes several vulnerabilities in the core, including a flaw in the update process that can lead to code execution on the server. On the same day, many vulnerabilities in WordPress plugins were published in public CVE databases. The most serious (Jupiter X Core, Pie Register Premium, Checkout Files Upload for WooCommerce, Contact Manager) let an attacker take over a website without logging in. Check that you have WordPress 7.1.4 and update all your plugins.
WordPress 7.1.4: a core security update to install straight away
On 28 October 2026, WordPress.org released WordPress 7.1.4, a security release with fixes for several vulnerabilities in WordPress core itself. The official announcement lists 13 groups of issues, and Patchstack counted 22 individual flaws within them. WordPress recommends updating websites immediately.
| What’s affected | WordPress core (not a plugin or theme) |
|---|---|
| Fixed version | 7.1.4; fixes are also backported to older branches (e.g. 7.0.8 and 6.9.11, all the way to the 4.7 branch) |
| Most serious flaw | A weakness in the update process that can lead to code execution on the server |
| Automatic updates | Websites with automatic security updates update themselves, but check the version anyway |
What WordPress 7.1.4 fixes
- A flaw in the update process: during a short update window, an attacker could access the temporarily unpacked installation in the
wp-content/upgrade/folder without logging in and run their own code through it. According to Patchstack, exploitation is difficult because the window only lasts a few seconds, but the consequences are serious. WordPress now gives temporary folders random names and protects the folder again. - Several stored XSS vulnerabilities (injected JavaScript code): in block markup, in the Interactivity API, in Customizer refresh, in the Categories, Playlist and Image blocks and in comment pagination blocks, in personal data erasure requests, and through specially crafted usernames.
- Denial of service (DoS) through the Interactivity API.
- Exposure of unpublished changes in the Customizer to visitors who aren’t logged in.
- Notes were visible to users who aren’t allowed to edit the post themselves.
- The bundled root certificates have been updated (revocation of the eMudhra issuer).
Recommendation
- In the admin, open Dashboard → Updates and check that it says WordPress 7.1.4 (or the corresponding fixed version of an older branch). If not, click Update now.
- Patchstack also advises that on the web server you block public access to the
wp-content/upgrade/folder. Ask your server administrator or host to do this. - Review users with the Contributor role or higher, as most XSS flaws can only be exploited by a logged-in user.
Critical WordPress plugin vulnerabilities: website takeover without logging in
On 28 October 2026, more than a hundred new WordPress-related records were published in the National Vulnerability Database (NVD). Below are the most dangerous ones, where the attacker doesn’t need a user account. By the time of publication, there were no reports of attacks in the wild for any of them, but attacks often start quickly after publication.
Jupiter X Core – logging in as an administrator (CVSS 9.8)
- Affected: the Jupiter X Core plugin (companion plugin for the Jupiter X theme), versions up to and including 4.61.0.
- Identifier: CVE-2026-106013, critical.
- What an attacker can do: because of a flaw in logging in via X (Twitter), they can log in without a password as a user linked to the X app, most often the website administrator.
- Fix: at the time of publication, the sources didn’t list a fixed version. Update the plugin to the latest version newer than 4.61.0 as soon as it’s available, and until then turn off login via X/Twitter.
Pie Register Premium – uploading malicious files (CVSS 9.8)
- Affected: the Pie Register Premium user registration plugin, versions up to and including 3.8.4.0.
- Identifier: CVE-2026-84999, critical.
- What an attacker can do: upload a PHP file without logging in and run it on the server, which means a full website takeover.
- Fix: update to the latest version newer than 3.8.4.0.
Checkout Files Upload for WooCommerce – uploading PHP files
- Affected: the Checkout Files Upload for WooCommerce plugin, versions before 2.4.0.
- Identifier: CVE-2026-103688 (source: WPScan).
- What an attacker can do: if the allowed file types field is empty (which is the documented way to allow “all files”), anyone can upload a PHP file and, on some servers, run their own code.
- Fix: update to 2.4.0 or later, and in the plugin settings enter only the file types you really need (e.g. pdf, jpg).
Contact Manager – file upload (CVSS 9.8)
- Affected: the Contact Manager plugin (by kleor), versions up to and including 9.1.2.
- Identifier: CVE-2026-109218, critical.
- What an attacker can do: bypass the ban on dangerous file extensions with a trick in the file name. Code execution is only possible under certain server conditions (Apache with mod_php).
- Fix: update to the latest version newer than 9.1.2.
Rank Math, MemberPress and other plugins: vulnerabilities that require a login or a click
For these vulnerabilities, the attacker needs an account on the website or has to lure a logged-in user to a malicious link. The risk is lower, but the consequences can be just as serious.
Rank Math SEO – code execution for contributors (CVSS 8.8)
- Affected: the Rank Math SEO plugin, versions up to and including 1.0.276.
- Identifier: CVE-2026-1928 (published 28 Oct 2026).
- What an attacker can do: a user with the Contributor role or higher can inject data through the REST API that leads to a malicious file being installed and code running on the server.
- Fix: newer versions (from 1.0.277 onwards) aren’t affected. Update to the latest version.
MemberPress – account takeover via a forged request (CVSS 8.8)
- Affected: the MemberPress membership plugin, versions up to and including 1.14.1.
- Identifier: CVE-2026-92797.
- What an attacker can do: if a logged-in user clicks a crafted link, the attacker changes their email address and then takes over the account through a password reset.
- Fix: update to the latest version newer than 1.14.1.
VikRentCar and IvyForms
- VikRentCar (up to and including 1.4.8, CVE-2026-111120, CVSS 8.8): if an administrator clicks a malicious link, the attacker can write PHP code into templates and take over the website. XSS and SQL injection vulnerabilities for contributors have also been published for versions up to 1.4.10 (CVE-2026-116749, CVE-2026-116750).
- IvyForms (up to and including 1.5.1, CVE-2026-109384, CVSS 8.8): a user with form editing rights can allow dangerous file extensions, after which anyone can upload a PHP file through a form.
- Recommendation: update both plugins to the latest version.
Vulnerabilities in WooCommerce and Elementor add-ons (medium severity)
The following vulnerabilities are less dangerous, but they affect very widely used plugins, so don’t put them off:
- Essential Addons for Elementor (before 6.8.7): a visitor who isn’t logged in can read the content of non-public post types and private fields (CVE-2026-110509) and bypass administrator approval (CVE-2026-110508). Update to 6.8.7 or later.
- Royal Elementor Addons (before 1.7.1070): several flaws, including misuse of stored Mailchimp data without logging in, exposure of submitted forms and redirecting form recipients (CVE-2026-107097, CVE-2026-107100, CVE-2026-106648 and others). Update to 1.7.1070 or later.
- PayPlug for WooCommerce (before 3.1.1): without logging in, it’s possible to read, change or cancel other customers’ orders (CVE-2026-113813, CVE-2026-110292). Update to 3.1.1 or later.
- Page Builder by SiteOrigin (before 2.38.0): stored XSS and exposure of drafts for contributors (CVE-2026-110506, CVE-2026-110507). Update to 2.38.0 or later.
- Ultimate Member (up to and including 2.14.0): stored XSS via the Website field in the profile, which even a subscriber can exploit (CVE-2026-107625). Update to the latest version.
- AI Engine (up to and including 3.8.4): with the public API turned on, a subscriber can delete files in the media library (CVE-2026-107745). Update to the latest version.
WordPress website security checklist
- Check your WordPress version (Dashboard → Updates): it must be 7.1.4 or the fixed version of your branch.
- Update all plugins and themes, especially those listed above. Make a backup first.
- Using Jupiter X? Turn off login via X/Twitter until there’s a fix.
- Check file upload forms: allow only the file types you need.
- Review user accounts: remove unknown administrators and unnecessary accounts with the Contributor role or higher.
- Remove plugins you don’t use. Even a deactivated plugin is an unnecessary risk.
You’ll find more guides to editing and maintenance in the WordPress support.
Need help with WordPress updates or security? We’ll update the core and plugins, check the server settings and review your website for signs of a hack. Email us at podpora@qstom.si.
Sources
- SI-CERT: security alerts (no new WordPress alert since the last review)
- WordPress.org: WordPress 7.1.4
- Cyber Security News: WordPress 7.1.4 Fixes 22 Security Flaws
- NVD: WordPress-related CVE records published 28 Oct 2026
- CVE Brief, 28 Oct 2026
- OffSeq: Jupiter X Core CVE-2026-106013
- TheHackerWire: Rank Math CVE-2026-1928
- WPScan: Checkout Files Upload for WooCommerce
- CVE records: CVE-2026-106013, CVE-2026-84999, CVE-2026-103688, CVE-2026-109218, CVE-2026-1928, CVE-2026-92797, CVE-2026-111120, CVE-2026-109384, CVE-2026-110509, CVE-2026-113813