How-To: Patch WordPress 7.1.4 With WP-CLI and Lock Down wp-content/upgrade

Attackers are racing the WordPress core updater. Here’s how I’d close it on a self-hosted WordPress box.

1. Check the version and update

wp core version
wp core update
wp core verify-checksums

verify-checksums flags core files that don’t match the official release.

2. Look for new admins

wp user list --role=administrator --fields=ID,user_login,user_registered

3. Block web access to the staging folder (nginx)

location ^~ /wp-content/upgrade/ {
    deny all;
}

WordPress unpacks updates there through the filesystem, not HTTP, so nobody should be fetching it from a browser. Run nginx -t, then reload.

4. Check the logs

grep -E 'wp-content/upgrade/.*\.php|setup-config\.php' /var/log/nginx/access.log*

On my servers, a change like this goes through Ansible so every site gets the same rule.

Review before you run anything: read the docs yourself, back up your config, and try it somewhere you can afford to break first.

God Bless, and May the Source Be with You!

References & Further Reading

• WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours (The Hacker News)
• wp core verify-checksums (WP-CLI docs)
• ngx_http_access_module (nginx docs)