WordPress has rolled out version 7.1.4 on October 28, 2026, to address 22 security vulnerabilities, including a critical unauthenticated remote code execution (RCE) issue. This security update also tackles stored cross-site scripting (XSS) vulnerabilities, data exposure risks, and access control weaknesses. Website administrators are urged to implement this update promptly to secure their sites.
Key Updates and Vulnerability Fixes
The update’s release announcement acknowledges security researcher Umut Bayram for identifying the update flaw. Patchstack’s technical analysis details 22 vulnerabilities across 17 advisories, explaining discrepancies between the advisory count and the total number of vulnerabilities.
Leading the release were Aaron Jorbin and Nik Tsekouras, with contributions from independent researchers and the WordPress Security Team. Their collective efforts have fortified both legacy and contemporary features against potential threats.
Addressing Serious Security Concerns
The most critical issue is linked to a race condition involving the update process, where an attacker could exploit a temporary installation. This requires no WordPress account but depends on precise timing during the update window when the wp-content/upgrade/ directory is accessible.
During updates, WordPress extracts files into this directory. Previously, predictable folder names and cleanup practices left an exposed path for unauthorized WordPress installer execution. The update now incorporates 16 random characters in temporary folder names, reinstates index.php protection, and ensures wp-config.php is not copied from the working directory. Patchstack rates such exploitation as challenging due to the fleeting opportunity it presents.
Stored XSS and Access Control Improvements
Numerous fixes are directed at the Interactivity API, which enables interactive page functionalities. Attackers with Contributor access could exploit crafted attributes that bypassed content filtering mechanisms to trigger unsafe browser actions. The update now prevents dangerous bindings and enhances security checks to mitigate denial-of-service risks that could incapacitate a user’s browser.
Additional stored XSS corrections involve crafted block markup, Customizer selective refresh, and navigation labels. These amendments also cover image and playlist processing safeguards. Stored XSS signifies that malicious scripts remain embedded on a site and execute when accessed by users.
Anthropic’s findings pointed out issues with personal data removal requests and specially crafted usernames, while a separate flaw in the Customizer allowed unpublished changes to be visible to non-account holders. WordPress has also reinforced note permissions to ensure unauthorized users cannot access certain posts.
Implementation and Future Outlook
Administrators can apply the update via the Dashboard under Updates or download WordPress 7.1.4 directly. Sites configured for automatic updates should receive the update, but verification of the installed version is recommended.
The version documentation includes patched older branches like 7.0.8 and 6.9.11, though not all branches might contain the full set of 22 vulnerabilities. Only the latest WordPress version receives active support, with versions 4.6 and earlier excluded from security updates.
Besides patching, Patchstack advises restricting web access to the wp-content/upgrade/ directory at the server level and reviewing accounts with Contributor privileges or higher. WordPress plugin firewalls may not shield the extracted installer because it functions independently. The release also updates bundled root certificates following the eMudhra revocation. While WordPress 7.2 is anticipated for December 8, site owners should prioritize this security update without delay.
