[{"data":1,"prerenderedAt":211},["ShallowReactive",2],{"seo-verification":3,"blog-wordpress-7-1-4-update-your-fleet-and-close-wp-content-upgrade-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-wordpress-7-1-4-update-your-fleet-and-close-wp-content-upgrade-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":33,"intro":36,"sections":37,"ctaTitle":158,"ctaBody":159,"ctaButton":160,"ctaUrl":161,"relatedPosts":162},550,"wordpress-7-1-4-update-your-fleet-and-close-wp-content-upgrade",{"fr":12,"en":10,"ar":13,"es":14},"wordpress-7-1-4-mise-a-jour-securite-wp-content-upgrade","ووردبريس-7-1-4-حدث-مواقع-عملائك-وأغلق-wp-content-upgrade","wordpress-7-1-4-actualizacion-seguridad-wp-content-upgrade","WordPress 7.1.4: update your fleet and close wp-content\u002Fupgrade\u002F","WordPress 7.1.4 fixes 22 flaws, including an upgrade race condition. WP-CLI inventory, branch table, nginx and Apache rules for agencies.",7,0,false,"2026-10-31T00:00:00+00:00","2026-10-31T19:07:30+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fwordpress-7-1-4-mise-a-jour-securite-wp-content-upgrade-poster.svg",{"categorySlug":34,"appSlug":35},"cms-websites","wordpress","On 28 October 2026, WordPress released version 7.1.4, a security release. Patchstack counts 22 vulnerabilities across 17 advisories, including a race condition in the core update process. For an agency managing dozens of client sites, the issue is not the flaw itself but the round: which version runs where, which branches received a fix, and which server rule covers the window that updating alone does not close. This guide gives the commands, the branch table and the nginx or Apache configuration.",[38,41,44,46,48,50,78,112,114,116,118,145,147,156],{"type":39,"title":40},"h2","A security release, not a routine update",{"type":42,"body":43},"p","The official WordPress 7.1.4 announcement is dated 28 October 2026 and presents it as a security release: it recommends updating immediately, and sites with automatic background updates will move on their own. According to Patchstack, WordPress counts 22 vulnerabilities across 17 advisories, against 7 for 7.1.3, released three weeks earlier. Seven of the seventeen advisories concern the Interactivity API, and most of the others are stored XSS issues that require at least a Contributor account. There is also an unpublished customizer changeset visible to an anonymous visitor, and a weakness in the update process itself. Neither the official announcement nor Patchstack reports any exploitation, and this article claims none.",{"type":39,"title":45},"The update race condition, and why not to wait",{"type":42,"body":47},"Before 7.1.4, the extraction folder created under `wp-content\u002Fupgrade\u002F` had a predictable name for packages uploaded from the admin, and the cleanup deleted everything in it, including the `index.php` file that blocks directory listing. During an update, a full copy of WordPress therefore sat at a guessable, browsable address, `wp-admin\u002Fsetup-config.php` included. No account or user action is required, but the attacker must hit a window of a few seconds. Patchstack rates exploitation as difficult and impractical; the window nonetheless comes back on every update, automatic ones included. The fix appends 16 random characters to the folder name, recreates `index.php` without deleting it, and stops `wp-config.php` from being copied out of the working directory. The agency objection remains: if it is hard to exploit, why act now? Because the core update comes first and costs one command per site, and closing the folder at server level is defense in depth. A PHP application firewall cannot hold it, since the extracted copy runs without the site's `mu-plugins`.",{"type":39,"title":49},"Inventory, then update every site in the fleet",{"type":51,"title":52,"steps":53},"steps","Eight WP-CLI steps, from checking to verifying",[54,57,60,63,66,69,72,75],{"title":55,"body":56},"Back up first","Export each site's database, then copy `wp-content` if no file backup exists yet:\n`wp db export pre-update.sql`",{"title":58,"body":59},"Find the installs","On a server hosting several accounts, list the `wp-config.php` files:\n`find \u002Fhome -name wp-config.php -not -path '*\u002Fwp-content\u002F*' 2>\u002Fdev\u002Fnull`",{"title":61,"body":62},"Read each site's version","For one site, then for a list of paths (one per line in `sites.txt`):\n`wp core version\nwp core check-update`\n`while read -r d; do printf '%s ' \"$d\"; wp --path=\"$d\" core version --skip-plugins --skip-themes; done \u003C sites.txt`",{"title":64,"body":65},"Spot branches without a fix","Compare each version to the table below: a 4.6 branch or older has no fix and drops out of the update round.",{"title":67,"body":68},"Update the core","To move to the latest version, run the first command; to stay on the installed branch and apply only its fix, run the second:\n`wp core update`\n`wp core update --minor`",{"title":70,"body":71},"Update the database","Apply any schema migrations:\n`wp core update-db`",{"title":73,"body":74},"Verify the result","Read the version again, then check the integrity of the core files:\n`wp core version\nwp core verify-checksums`",{"title":76,"body":77},"Loop over the fleet","Replay the branch update on every path in the list:\n`while read -r d; do wp --path=\"$d\" core update --minor && wp --path=\"$d\" core update-db; done \u003C sites.txt`",{"type":79,"title":80,"headers":81,"rows":85},"comparison","Fixed version per branch, 28 October 2026",[82,83,84],"Installed branch","Fixed version","Agency action",[86,90,94,97,100,104,108],[87,88,89],"7.1","7.1.4","Update; automatic core updates handle it if enabled",[91,92,93],"7.0","7.0.8","Minor update, then plan the branch upgrade",[95,96,93],"6.9","6.9.11",[98,99,93],"6.8","6.8.12",[101,102,103],"6.7, 6.6, 6.5, 6.4","6.7.11, 6.6.11, 6.5.14, 6.4.14","Minor update, then prioritise the branch upgrade",[105,106,107],"6.3 to 4.7","One fix per branch, down to 4.7.39","Minor update, then migrate to a current branch",[109,110,111],"4.6 and earlier","No fix","Do not patch: migrate the site",{"type":42,"body":113},"The agency rule fits in one sentence: a site on a branch without a fix gets migrated, not patched. The official post states that fixes are backported to every eligible branch, currently through 4.7, and that they roll out as they become ready; confirm on wordpress.org which number is available for each branch before promising a date to the client. On responsibility, you are the one the client calls if a site goes down: record per site the version before, the version after and the time of the operation, and keep that log available to the client. For the PHP inventory of the same fleet, see the dedicated article; for an earlier core flaw, see the one on 7.1.2.",{"type":39,"title":115},"Closing wp-content\u002Fupgrade\u002F at server level",{"type":42,"body":117},"The source establishes one thing only: deny web access to `wp-content\u002Fupgrade\u002F` and confirm the folder is not listable; between two updates it should contain only `index.php`. The rules below are therefore generic hardening that we propose, not an instruction from the advisory. The update goes through PHP's filesystem rather than an HTTP request, so refusing web access does not get in its way. This block does not replace the core update: it closes the window during future operations. Always place the rule at site or server level, never inside the folder itself, which the update process manipulates.",{"type":51,"title":119,"steps":120},"Eight actions by environment, from blocking to proof",[121,124,127,130,133,136,139,142],{"title":122,"body":123},"nginx: block the folder","Add it to the site's `server` block, before the block that handles PHP files; the `^~` modifier stops a regular expression from taking precedence:\n`location ^~ \u002Fwp-content\u002Fupgrade\u002F {\n    return 404;\n}`\nThen test and reload:\n`nginx -t && systemctl reload nginx`",{"title":125,"body":126},"nginx: one rule for the whole fleet","Put the rule in a snippet file and include it in every vhost, so a new site receives it too:\n`include \u002Fetc\u002Fnginx\u002Fsnippets\u002Fwp-upgrade-deny.conf;`",{"title":128,"body":129},"Apache: Directory block","In the vhost configuration, with the site's real path:\n`\u003CDirectory \"\u002Fvar\u002Fwww\u002Fyour-domain.com\u002Fwp-content\u002Fupgrade\">\n    Require all denied\n\u003C\u002FDirectory>`\nThen validate and reload:\n`apachectl configtest && systemctl reload apache2`",{"title":131,"body":132},"Shared hosting or cPanel: .htaccess","Without access to the server configuration, add a redirect to a 404 error at the site root, in the existing `.htaccess`:\n`RedirectMatch 404 ^\u002Fwp-content\u002Fupgrade(\u002F|$)`",{"title":134,"body":135},"Docker: where to put the rule","The rule goes in the container that serves HTTP: the nginx reverse proxy or the image's Apache configuration. Mount it as a volume so it survives a rebuild, then reload the container.",{"title":137,"body":138},"Prove it answers 403 or 404","Test the folder and its `index.php` from outside; each line must return 403 or 404, not 200:\n`curl -I https:\u002F\u002Fyour-domain.com\u002Fwp-content\u002Fupgrade\u002F\ncurl -I https:\u002F\u002Fyour-domain.com\u002Fwp-content\u002Fupgrade\u002Findex.php`",{"title":140,"body":141},"Cover every vhost","List the sites that lack the rule; the list must be empty after a deployment:\n`grep -L -E 'wp-content\u002Fupgrade|wp-upgrade-deny' \u002Fetc\u002Fnginx\u002Fsites-enabled\u002F*`",{"title":143,"body":144},"Check the folder contents","Outside an update in progress, only `index.php` should appear:\n`ls -A \u002Fvar\u002Fwww\u002Fyour-domain.com\u002Fwp-content\u002Fupgrade`",{"type":39,"title":146},"External authors: what Contributor XSS changes",{"type":148,"title":149,"items":150},"ul","Five checks on a client site's accounts",[151,152,153,154,155],"**List the accounts** — spot Contributor roles and above:\n`wp user list --role=contributor --fields=ID,user_login,user_registered`","**Remove what is unused** — delete or demote accounts of former contractors and departed writers.","**Do not open accounts for convenience** — a stored XSS needs an account that writes; fewer accounts, less surface.","**Warn administrators** — several flaws trigger when an administrator opens a booby-trapped item or the customizer screen.","**Update before reviewing** — apply 7.1.4 before reopening external contributors' drafts.",{"type":42,"body":157},"A security release is mostly a test of method. If the inventory, the update and the server rule take a morning on ten sites, they will take three days on a hundred. An agency space centralises cPanel accounts, hosting plans and expirations, so the round starts from an up-to-date list rather than a search.","A client fleet that updates without eating your day","Find cPanel accounts, hosting plans and expirations in one place in an agency space, and start from an up-to-date list at every security release.","Discover the agency space","\u002Fsolutions\u002Fagences",[163,179,195],{"id":164,"slug":165,"slugs":166,"title":170,"excerpt":171,"readTime":23,"views":18,"isPinned":19,"publishedAt":172,"updatedAt":173,"category":174,"categories":175,"featuredImage":30,"bgImage":31,"posterImage":177,"relatedSolution":178},373,"wordpress-cve-2026-87902-update-to-712-now",{"fr":167,"en":165,"ar":168,"es":169},"wordpress-cve-2026-87902-rce-mise-a-jour-7-1-2","ووردبريس-cve-2026-87902-ترقية-7-1-2","wordpress-cve-2026-87902-actualiza-a-712-urgente","WordPress CVE-2026-87902: Update to 7.1.2 Now","CVE-2026-87902 (CVSS 9.2) actively exploited since Sept. 22, 2026. Check your version, apply WordPress 7.1.2, and see why shared hosting extends exposure.","2026-09-24T00:00:00+00:00","2026-10-26T18:53:20+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[176],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fwordpress-cve-2026-87902-rce-mise-a-jour-7-1-2-poster.svg",{"categorySlug":34,"appSlug":35},{"id":180,"slug":181,"slugs":182,"title":186,"excerpt":187,"readTime":188,"views":18,"isPinned":19,"publishedAt":189,"updatedAt":190,"category":191,"categories":192,"featuredImage":30,"bgImage":31,"posterImage":194,"relatedSolution":30},508,"php-version-inventory-for-client-sites-an-agency-method",{"fr":183,"en":181,"ar":184,"es":185},"inventaire-versions-php-parc-sites-clients-agence","جرد-إصدارات-php-لمواقع-العملاء-منهج-للوكالات","inventario-de-versiones-php-de-sitios-cliente-metodo-de-agencia","PHP version inventory for client sites: an agency method","Build a register of the PHP version served by every client site across several hosts: access tiers, batch scripts, priority batches, client message, dated proof.",11,"2026-10-27T00:00:00+00:00","2026-10-27T23:58:39+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[193],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Finventaire-versions-php-parc-sites-clients-agence-poster.svg",{"id":196,"slug":197,"slugs":198,"title":202,"excerpt":203,"readTime":188,"views":204,"isPinned":19,"publishedAt":205,"updatedAt":206,"category":207,"categories":208,"featuredImage":30,"bgImage":31,"posterImage":210,"relatedSolution":30},317,"linux-vps-hardening-checklist-for-agencies",{"fr":199,"en":197,"ar":200,"es":201},"linux-hardening-vps-checklist","قائمة-تصليب-خادم-لينكس-للوكالات-بعد-التسليم","hardening-linux-vps-checklist-para-agencias-tras-la-entrega","Linux VPS Hardening Checklist for Agencies","Reproducible Linux hardening checklist for agencies: auditd, sudo user, SSH key auth, UFW, fail2ban and root lockout — with per-client traceability.",2,"2026-08-30T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[209],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Flinux-hardening-vps-checklist-poster.svg",1793480386021]