WordPress 7.1.4 fixes 22 security flaws, most open to anyone with a writer account. Check every site’s version

WordPress shipped version 7.1.4 on Wednesday as a security release and asked site owners to update immediately. It fixes 22 vulnerabilities, most of them ways for a logged-in contributor or author to plant script that runs in an editor’s or admin’s browser.

Sites with automatic background updates should already be moving. The ones to chase are sites where someone turned updates off, or where a host or agency holds them back.

WordPress 7.1.4 fixes 22 security issues. Most need a contributor account, which is exactly what agencies, guest writers and old staff logins tend to have.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

WordPress 7.1.4 fixes 22 security issues

WordPress 7.1.4 came out on October 28. The release notes list a weakness in the upgrade process that can lead to remote code execution during the upgrade window, reported by Umut Bayram, along with stored cross-site scripting (XSS) issues in block markup, Privacy Data Removal Requests, the Interactivity API, Customizer selective refresh, the Categories, Playlist and image blocks, the comments pagination blocks and specially crafted user logins.

It also fixes a stored denial of service in the Interactivity API, unpublished Customizer changesets that unauthenticated visitors could find, and Notes that some privileged users could read without edit access. The bundled root certificates were updated because of the eMudhra revocation.

The HelpHub page says WordPress 7.0 and 6.9 are affected by all 22 issues and got 7.0.8 and 6.9.11. Patchstack lists backports down to 4.7.39 and says sites on 4.6 or older get nothing.

Sites where contributors and authors can publish

Patchstack’s review says nearly every fix needs an account first, usually Contributor, so the risk scales with who can log in. Stored XSS from a contributor runs when an editor or administrator opens the post, which is how a low account becomes an admin session.

The one issue with no account needed is the upgrade-window bug. Patchstack explains that during an update WordPress unpacked the package into a predictable, browsable folder under wp-content/upgrade/, where a copy of setup-config.php could run. Patchstack rates it hard to hit because the window lasts seconds, and 7.1.4 now adds random characters to that folder name.

Confirm every site shows 7.1.4 or its branch backport

• Check the version on every site under Dashboard, then Updates, or with wp core version. Anything below 7.1.4 should show the backport for its branch, such as 7.0.8 or 6.9.11.
• For sites where background updates are off, or a host or agency manages them, ask for the update date in writing.
• Review who holds Contributor, Author and Editor roles, and remove accounts for people who no longer write for you.
• Confirm wp-content/upgrade/ cannot be listed in a browser.

Details

• Release: WordPress 7.1.4, October 28, 2026, short-cycle security release led by Aaron Jorbin and Nik Tsekouras. WordPress 7.2 Beta 3 has the same fixes; 7.2 is planned for December 8.
• Backports: 7.0.8 and 6.9.11 (all 22 issues), then 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14 and older branches down to 4.7.39 (Patchstack).
• Upgrade-window fix (Patchstack): the extraction folder gets 16 random characters, index.php is recreated and kept, and wp-config.php is added to the files never copied out of the working directory.
• Exploitation: neither WordPress nor Patchstack reports attacks using these issues.

Hunt / verify

• Across many sites, wp core version --path=<site> or your management dashboard gives a quick list; sort by version.
• Use wp user list --role=contributor (and author, editor) to find accounts nobody recognizes, and check their last posts for odd block markup or javascript: links.
• Open your site’s /wp-content/upgrade/ path in a browser. A directory listing means the folder is exposed.

Source: WordPress 7.1.4 release notes

Sources

• WordPress.org: WordPress 7.1.4
• WordPress HelpHub: Version 7.1.4
• WordPress.org: Releases
• Patchstack: WordPress 7.1.4 Security Release

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].