WordPress 7.1.4 is out as a security release, and WordPress.org News says sites should be updated immediately. The release fixes a remote code execution weakness in the core upgrade process along with a long list of stored cross-site scripting (XSS) bugs. If you manage client sites, this is a drop-everything update.
What we know
WordPress.org News published the 7.1.4 announcement on October 28, 2026. Aaron Jorbin posted it under Releases and Security, and the WordPress.org Documentation page for Version 7.1.4 gives the same date.
The headline fix is the RCE. According to WordPress.org News, the release closes a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window. Umut Bayram reported it. The official documentation describes it as a race condition during core updates.
The XSS coverage is also accurate. WordPress.org News lists stored XSS fixes in specially crafted block markup, Customizer selective refresh, the Categories block, the Playlist and image blocks, and the comments-pagination-next and comments-pagination-previous blocks. It also lists multiple Interactivity API issues.
Anthropic is credited with two reports. In one, Privacy Data Removal Requests can be created in a way that leads to stored XSS. In the other, specially crafted user logins can lead to stored XSS.
WordPress.org also lists these fixes:
- Unpublished Customizer changesets could be discovered by unauthenticated users. Antonio Lorensius Silaban reported this one.
- Contributor+ stored XSS and denial-of-service issues in Interactivity API bindings.
- An update to the bundled root certificates following the eMudhra revocation.
On updating, WordPress.org and the WordPress X account say to go to Dashboard > Updates and click Update Now, or to download the release from WordPress.org. Sites with automatic background updates are expected to update on their own, but you should still confirm that the update completed.
This follows 7.1.3, which was also a security release.
What is rumored
HOL Guard, a security vendor whose track record we could not verify, says on its hol.org blog that the RCE is unauthenticated. Its analysis says the unpacked copy of WordPress in wp-content/upgrade/ can be reached mid-update, and that an attacker could plant a wp-config.php. It also says this window opens on every update, including the one that installs 7.1.4. That is the vendor’s interpretation. The official material we reviewed does not say it.
HOL Guard also recommends blocking web access to wp-content/upgrade/. That advice comes from the vendor, not from WordPress.org. If you try it, test the server rule on staging first.
The same vendor counts 22 vulnerabilities across 17 advisories, with only one that requires no login. It says that as of 2:50 PM ET on October 28, no CVE IDs or advisories had been published and no exploitation had been reported. The official post gives no total, and the no-exploitation note reflects only that moment.
HOL Guard, Windows Report and Encode.host report patched versions for older branches, including 7.0.8, 6.9.11 and 6.8.12. They say fixes are backported to eligible branches down to 4.7 and that WordPress 7.2 is planned for December 8, 2026. None of this is confirmed on an official page we checked.
Mark Gadala-Maria also posted on X, calling the release “BREAKING” and citing 22 patched vulnerabilities, including AI-discovered ones. That single-source post repackages the WordPress.org announcement, and its numbers are unverified.
What we don’t know yet
There is no official word yet on whether the RCE needs authentication, how many vulnerabilities were fixed in total, or which CVE IDs apply. The exact patched version numbers for older branches still need checking on WordPress.org’s releases page.
What it means
For site owners, the official guidance is to update now. Here is the order I use for client sites:
- Back up the site.
- Update to 7.1.4, or to the patched release for your branch once you have confirmed its number on WordPress.org.
- Check that Dashboard > Updates shows 7.1.4 and that automatic updates actually finished. Don’t assume they did.
- On staging, test blocks, the Customizer, themes and plugins built on the Interactivity API, and comments pagination.
- Review Contributor and Author accounts. Several fixes involve logged-in contributors, so prune any accounts you don’t need.
- If you are on an older branch, plan your move to the current release rather than relying on backports.
Auto-updates should handle most sites. On the sites you’re responsible for, check by hand anyway.