WordPress released version 7.1.4 on October 28, 2026, a security update that fixes several flaws, including one in the core update process itself. The project recommends installing it immediately. It applies to every WordPress site, including those still running older branches.
What we know
- What shipped and when: WordPress 7.1.4, on October 28, 2026, according to the official WordPress.org announcement by Aaron Jorbin. The post says sites should be updated "immediately".
- How many flaws: the announcement groups the fixes into 12 items, plus an update to the bundled root certificates after the eMudhra certificate authority revocation. The WordPress.org release page refers to 22 vulnerabilities and 32 changed files.
- What kind: according to that page, most are stored cross-site scripting (XSS) issues, and nearly all that state a role require a Contributor-level account or higher. One exposes unpublished Customizer changes to logged-out visitors. Another, in the core update process, could allow remote code execution.
- What they do not say: neither the announcement nor the release page gives CVE IDs or severity ratings, and neither says any flaw is being exploited.
- Who reported them: the post credits several researchers, the WordPress Security Team and Anthropic, which reported two of the issues.
- Older branches: the fixes are being backported to every branch still eligible for security fixes, currently back to 4.7. The release page lists 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11 and 6.5.14, among others. Version 4.6 and earlier no longer get patches.
- What's next: WordPress 7.2 Beta 3 already includes the fixes, and 7.2 is planned for December 8, 2026, per the announcement.
What changes and what doesn't
- Changes: the minimum safe version. On the 7.1 branch it is 7.1.4; on each older branch, its new minor release.
- Doesn't change: how you install it. It is a minor release, and sites with automatic background updates start updating on their own, according to the post.
- Not an active-attack alert: nothing in the official sources points to exploitation. But the fixes are now public, which makes them easier to study.
- Not a plugin fix: 7.1.4 patches WordPress core; plugins and themes are updated separately.
How to tell if you're affected
- Check your version. In the WordPress dashboard, go to Dashboard → Updates. It also shows in the bottom-right corner of any admin screen.
- Confirm the auto-update landed. If you see 7.1.4 (or 7.0.8, 6.9.11 or 6.8.12 on those branches), you're done. If not, take a backup and click "Update now".
- Multi-author sites go first. Since almost every flaw needs a Contributor account or higher, sites with freelance writers, former staff accounts or open registration carry more risk. Review Users and remove accounts nobody uses.
- On an older branch, install at least your branch's fixed version. If you are still on 4.6 or earlier, there is no patch: plan the migration.
- If someone else runs your site (managed hosting or an agency), ask which version it runs today and when it was updated. Don't forget staging or test copies: they are WordPress too.
Related: WordPress 7.1.3 Fixes 7 Security Flaws: Update Your Site Now
Sources
Updates: if WordPress publishes CVE IDs or reports attacks against these flaws, they will be added here with a link.