WordPress pushed out version 7.1.4 on October 28, 2026, closing 22 security flaws and urging site owners to update immediately. The release addresses a range of issues from an unauthenticated remote code execution risk in the update process to multiple stored cross-site scripting and access-control problems. With fixes spanning recent and older branches, the update is a reminder that timely patching remains critical for every WordPress site.
The unauthenticated update-time RCE and how it worked
The most serious vulnerability in this release is a race condition tied to WordPress’s update process. During an update, WordPress unpacks files into wp-content/upgrade/ using predictable temporary folder names. If an attacker could reach an unpacked installer in that short window—when index.php protection might be missing—they could run setup pointing to a database they control and gain a path to code execution without any WordPress account. Exploitation requires precise timing and public access to the upgrade directory, making it difficult but potentially severe. WordPress mitigated the issue by adding 16 random characters to temporary folder names, restoring index.php protections, and preventing wp-config.php from being copied from the working directory.
Who reported the issues and how they were analyzed
The release credits security researcher Umut Bayram for reporting the update flaw. Patchstack supplied technical analysis showing 22 distinct vulnerabilities broken across 17 advisories, explaining the difference between the advisory count and the total flaw count. The update was led by Aaron Jorbin and Nik Tsekouras, with multiple independent researchers and the WordPress Security Team contributing reports that closed weaknesses across both older and newer features.
Stored XSS, Interactivity API, and permission hardening
Several fixes target stored cross-site scripting (XSS) and permission gaps tied to interactive features. The Interactivity API—used for interactive page elements—could allow attackers with Contributor access to save crafted attributes that passed filters but later triggered unsafe browser actions. The update blocks dangerous bindings, tightens checks, and fixes a denial-of-service condition that could freeze a visitor’s browser tab. Other stored XSS fixes address crafted block markup, the Customizer selective refresh, Categories, navigation labels, and image and playlist processing. These changes reduce the risk that malicious script content stored on a site will execute when viewed by other users.
Data exposure, notes, and user-related issues
The release also addresses reports from Anthropic about personal data removal requests and specially crafted usernames. A separate Customizer flaw could expose unpublished changes to unauthenticated visitors, and WordPress tightened note permissions so users can’t access notes attached to posts they’re not permitted to edit. These fixes build on previous updates that targeted similar data exposure and permission weaknesses.
How to install the update and what site owners should check
Administrators can install WordPress 7.1.4 from Dashboard → Updates → Update Now or download it directly. Sites using automatic background updates should receive the patch, but owners are advised to confirm their installed version rather than assume the update completed. The official documentation lists patched older branches—including 7.0.8, 6.9.11, and releases back to 4.7.39—while noting that not every branch contained all 22 flaws. Only the latest WordPress branch remains actively supported.
Additional hardening advice from Patchstack
Beyond applying the update, Patchstack recommends blocking web access to wp-content/upgrade/ at the webserver layer and reviewing accounts with Contributor privileges or higher. Site owners should note that a plugin firewall may not protect an extracted installer copy, because the unpacked files can load independently. The release also updates bundled root certificates following the eMudhra revocation.
Why you shouldn’t wait for the next major release
WordPress 7.2 is scheduled for December 8, but the 7.1.4 security release is time-sensitive and should not be deferred. Even though exploiting the worst flaw requires a narrow window, the potential impact of an unauthenticated path to code execution makes immediate patching prudent.
Final takeaways
This security release underscores the layered nature of WordPress risk: predictable temporary paths, insufficient hardening of interactive features, and permission edge cases can combine to create serious vulnerabilities. Install 7.1.4, verify your site version, review user roles, and consider server-level protections for upgrade directories. With AI making cyberattacks faster and cheaper, rapid patch management and defense-in-depth remain essential.
Licensed under CC BY-ND 4.0 International