WordPress 7.1.4, released on October 28, 2026, is a security release fixing 22 vulnerabilities, including a race condition during core updates that could lead to remote code execution and many stored cross-site scripting (XSS) bugs. WordPress recommends updating immediately. Check that every site you run now reports 7.1.4, or the patched version for its branch.
This is the second WordPress security release in October, after WordPress 7.1.3 on October 6, and it lands a week after the critical PHP fixes. Below is what was fixed, who is most exposed and a checklist you can work through in under an hour.
Key takeaways
- WordPress 7.1.4 was released on October 28, 2026 as a security release, and WordPress recommends updating immediately.
- The fixes include a race condition during core updates that could lead to remote code execution and many Contributor+ stored XSS issues, mostly in Interactivity API bindings.
- Fixed versions also shipped for older branches back to 4.7, such as 7.0.8 and 6.9.11; WordPress 4.6 and earlier get no security updates.
- The release also updates bundled root certificates after the eMudhra revocation, and WordPress 7.2 is planned for December 8.
What happened
The WordPress 7.1.4 announcement, dated October 28, 2026 and led by Aaron Jorbin and Nik Tsekouras, calls it "a security release" and advises updating "immediately." The version 7.1.4 release notes count 22 vulnerabilities across supported branches.
Grouped in plain English, the fixes cover:
| Area | Issue reported | What it means |
|---|---|---|
| Core updates | A race condition during core updates that could lead to remote code execution | The update process itself had a window an attacker could abuse |
| Interactivity API | Several Contributor+ stored XSS issues (via javascript: URLs, event handler bindings, prototype pollution) plus a denial of service issue |
Low-level accounts could plant script that runs for other users |
| Blocks | Stored XSS in Comments Pagination and Post Navigation Link labels, XSS in the Categories block, hardening in Image and Playlist blocks | Content blocks could carry injected script |
| Block parser | Contributor+ stored XSS via whitespace in block delimiters | Crafted block markup could slip past filtering |
| Customizer | Stored XSS in selective refresh, and unpublished Customizer changes visible to unauthenticated visitors | Draft design changes could leak, and script could be injected |
| Privacy tools | Editor+ stored XSS in the personal data erasure requests screen | Script could run when an admin opens privacy requests |
| Notes | Custom comment-moderating roles could read, edit and delete notes on posts they cannot edit | A permissions gap in editorial notes |
| Multisite | Hardening for unescaped usernames on Network Users screens | Safer display of usernames in network admin |
| Certificates | Bundled root certificates updated due to the eMudhra revocation | Not a vulnerability; keeps outgoing HTTPS connections trusted |
The release notes credit several reporters, including Umut Bayram for the update race condition, Rafie Muhammad of Awesome Motive, Ben Bidner, rekter0, and members of the WordPress Security Team. Two issues are credited to Anthropic.
The announcement does not say any of these issues are being exploited.
Fixed versions for older branches
WordPress shipped fixes for older branches "as a courtesy," while reminding site owners that "only the most recent version of WordPress is actively supported." The release notes list how many of the 22 issues affect each branch:
| Branch | Affected by | Fixed version |
|---|---|---|
| 7.0 | All 22 | 7.0.8 |
| 6.9 | All 22 | 6.9.11 |
| 6.8 | 20 of 22 | 6.8.12 |
| 6.7 | 20 of 22 | 6.7.11 |
| 6.6 | 19 of 22 | 6.6.11 |
| 6.5 | 17 of 22 | 6.5.14 |
| 6.4 | 17 of 22 | 6.4.14 |
| 6.0 to 6.3 | 9 of 22 | 6.0.18, 6.1.16, 6.2.15, 6.3.14 |
| 5.0 to 5.9 | 6 to 9 of 22 | See release notes |
| 4.7 to 4.9 | 2 to 4 of 22 | 4.7.39, 4.8.34, 4.9.35 |
| 4.6 and earlier | Not patched | No longer receive security updates |
WordPress 7.2 Beta 3 also carries the fixes, and WordPress 7.2 is "currently planned for December 8th." Our WordPress 7.2 Beta 1 post covers what is coming.
Who this affects
- Every WordPress site, from a local service brochure site to a WooCommerce store.
- Sites with several contributors, authors or editors. Most of the XSS issues need at least a Contributor account. That makes sites with guest writers, agencies, interns or old staff accounts more exposed than a single-admin site.
- Sites that use the Customizer, where unpublished changes could be seen by visitors before the fix.
- Multisite networks, which get a username escaping fix on the Network Users screens.
- Sites on old branches that cannot move to 7.1 yet. Patched point releases exist back to 4.7, but sites on 4.6 or earlier have no fix.
- Businesses with auto-updates turned off, for example after a plugin conflict. They need to update by hand.
What to do now
- Confirm the version on every site. In the dashboard, go to Dashboard, then Updates. WordPress says sites with automatic background updates will start updating on their own, but plugins, host settings or file permissions can block that. For a quick outside view, our website technology checker can help you see which sites in your portfolio run WordPress.
- Back up first. A backup takes minutes and turns a bad update into a short delay. Our website backup guide covers what to keep.
- Update core, then plugins and themes. Clear your caching plugin and CDN cache afterward so visitors get the patched code.
- If you are on an older branch, at least move to its latest point release (for example 7.0.8 or 6.9.11), then plan the move to 7.1.4. Older branches are patched only as a courtesy.
- Review user accounts and roles. Because most fixes involve Contributor, Author or Editor accounts, remove old staff, freelancer and test accounts, and reduce roles to what each person needs. Turn on two-factor authentication for admin logins.
- Check recent content from low-privilege accounts. If you allow outside contributors, look over recent drafts and posts for odd embeds or scripts. Our guide to the signs your website was hacked lists what to watch for.
- Check PHP too. A WordPress update does not patch the server. If you have not confirmed it yet, see our PHP critical security release guide for the October 21 fixes.
- Test the live site. Load key pages, submit your contact form and run a test order. Our website down checker confirms the site responds, the security headers checker confirms your headers survived, and the SSL checker confirms the certificate your site serves. The free tools at /tools need a free account.
For the bigger picture on the certificate change bundled into this release, see our post on the eMudhra certificate compromise. For an ongoing routine, work through our WordPress security checklist.
Make It Flow can help small teams set up update monitoring and alerts, so a person only needs to step in when an update fails or needs a decision.
Frequently asked questions
What is fixed in WordPress 7.1.4?
WordPress 7.1.4 fixes 22 vulnerabilities, according to its release notes. They include a race condition during core updates that could lead to remote code execution, many stored XSS issues (mostly in Interactivity API bindings and blocks), a Customizer information leak and a permissions issue with notes. It also updates bundled root certificates after the eMudhra revocation.
Will WordPress update to 7.1.4 automatically?
WordPress says sites that support automatic background updates will begin updating automatically. Hosts may also manage updates for you. Auto-updates can still fail or be switched off, so check Dashboard, then Updates, on each site.
Is WordPress 7.1.4 being actively exploited?
The announcement does not say any of the issues are being exploited. Once fixes are public, attackers can study what changed, so updating promptly is the safest choice.
I can't update to 7.1 yet. Is there a fix for my version?
Probably. WordPress released patched versions for older branches back to 4.7, such as 7.0.8, 6.9.11 and 6.8.12. WordPress 4.6 and earlier no longer receive security updates, and WordPress says only the latest version is actively supported.
Do I need to update plugins as well as WordPress core?
Yes, as a routine. WordPress 7.1.4 fixes core only. Plugins and themes have their own updates and their own vulnerabilities, so update them in the same session after taking a backup.
When is WordPress 7.2 coming out?
The 7.1.4 announcement says WordPress 7.2 is currently planned for December 8, 2026. WordPress 7.2 Beta 3 already includes the 7.1.4 security fixes.
Sources
More guides for your industry
Free checklist (PDF)
Free e-commerce brands website checklist
30 practical checks for e-commerce brands: website speed and mobile, Google Business Profile and reviews, email security, booking and enquiry handling, and AI search visibility. Each one says why it matters, and many link to a free tool that checks it.
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
