WordPress 7.1.4 Security Update Explained: 22 Flaws Fixed, Including an Update-Process RCE

WordPress 7.1.4 security update — WordPress logo

Image: Wikimedia Commons / WordPress logo

TL;DR: The WordPress 7.1.4 security update fixes 22 flaws, including a remote code execution weakness hiding inside WordPress's own update process. Released on 28 October 2026, it also patches stored cross-site scripting bugs, an information leak and the eMudhra root certificates. WordPress says update immediately — sites with automatic background updates should already be moving.

📌 KEY HIGHLIGHTS

WordPress 7.1.4, released 28 October 2026, is a security-only release fixing 22 vulnerabilities across 17 advisories, according to Patchstack's count of the official release notes.
The most serious flaw is a race condition in the core upgrade process that could lead to remote code execution during the short update window — reported by researcher Umut Bayram.
Most other fixes are stored cross-site scripting (XSS) flaws that need a Contributor-level account or higher, plus one leak that let logged-out visitors discover unpublished Customizer changes.
Backports shipped the same day for every supported branch down to version 4.7; WordPress 7.2 Beta 3 already contains the fixes.
No active exploitation of these flaws has been reported by WordPress or Patchstack — but the update-process flaw is the one to patch first, because it sits in trusted code.

What happened?

WordPress has released version 7.1.4 as a short-cycle security release, and its message is blunt: update your sites immediately. The release, published on 28 October 2026 and led by Aaron Jorbin and Nik Tsekouras, contains no new features — only security fixes, backported to all branches eligible for security support, currently through version 4.7.

The headline flaw is unusual because it lives in the machinery WordPress uses to update itself. During a core update, WordPress extracts files into a temporary wp-content/upgrade/ directory. Patchstack's analysis explains that predictable temporary folder names and cleanup that removed index.php protection could expose an unpacked installer during the update window — and an attacker reaching it at exactly the right moment could run setup against a database they control, opening a path to remote code execution without needing a WordPress account.

WordPress 7.1.4 closes that window: temporary folders now get 16 random characters in their names, index.php protection is restored, and wp-config.php can no longer be copied from the working directory. Patchstack rates exploitation as difficult, because the opportunity lasts only seconds — but difficult is not impossible, and the fix costs nothing to install.

What else does WordPress 7.1.4 fix?

Beyond the update-process flaw, the release patches a cluster of stored XSS issues — flaws where malicious script gets saved on the site and later runs in another user's browser. Most need an account first, usually Contributor or higher, which is why Patchstack recommends reviewing who holds Contributor-or-higher roles on your site. The full list from the official release notes:

Fix area	What it stops	Who it needs
Core upgrade process	Race condition leading to remote code execution during updates	No account, but precise timing during an update
Interactivity API	Multiple stored XSS flaws + one stored denial-of-service issue	Logged-in account (usually Contributor+)
Block markup & blocks	Stored XSS via specially crafted block markup, Categories, Playlist and Image blocks, Comments Pagination and Post Navigation Link blocks	Logged-in account
Customizer	Stored XSS in selective refresh; unpublished changesets discoverable by logged-out visitors	Second item: no account
Privacy data removal requests	Stored XSS via crafted removal requests	Logged-in account
Notes on posts	Privileged users reading notes on posts they cannot edit	Privileged account without edit access
Bundled root certificates	Certificates updated after the eMudhra revocation	—

WordPress dashboard updates screen for the WordPress 7.1.4 security update

Illustrative image: The WordPress dashboard, where site owners install updates — Image: Wikimedia Commons

Why it matters for site owners

WordPress powers a huge share of the web, so a security release like this one is really a deadline in disguise. The stored XSS flaws matter most on sites where people other than the owner can log in and write — staff blogs, membership sites, guest-author setups and WooCommerce stores with vendor accounts. On a single-author blog with no other logins, the risk is lower, but the update-process flaw applies to every site equally, because every site updates.

There is also a trust angle. Update paths are normally the most trusted code paths on a site: you run them precisely because you believe they make you safer. A flaw in the updater itself breaks that assumption, which is why WordPress and Patchstack both put this release at the top of the patch queue even though exploitation is difficult and none has been reported in the wild.

The eMudhra certificate refresh is a quieter but telling detail: it follows Chrome's revocation of trust in the Bengaluru-based certificate authority's emSign ECC Root CA – G3 on 27 October, after eight of its intermediate certificates were found to have generated private keys weakly. WordPress is now carrying the corrected certificate bundle, just as Python and Flutter did in their own recent security releases.

Should you update now, or wait?

✅ Update now — this is not one to schedule for later. Install 7.1.4 (or the backported fix for your branch) from Dashboard > Updates, then check that automatic background updates are on. If you run a multi-author site, also review who holds Contributor or higher roles, since that is where nearly all of these flaws begin.

How to update to WordPress 7.1.4

1. Back up your site (files + database) — a one-click backup plugin or your host's snapshot is enough.
2. Go to Dashboard > Updates and click "Update Now". Sites with automatic background updates enabled should begin updating on their own.
3. After updating, confirm the version in the bottom-right of the dashboard reads 7.1.4 (or your branch's backported version).
4. If you manage many sites, update staging first only if you can do it within the day — do not let the live site sit unpatched while staging is tested for a week.

FAQs

What is WordPress 7.1.4? WordPress 7.1.4 is a security-only release published on 28 October 2026. It fixes 22 vulnerabilities, including a remote code execution weakness in the core update process, and carries no new features. The next major release, WordPress 7.2, is planned for 8 December 2026.

Do I need to update to WordPress 7.1.4? Yes — WordPress recommends updating immediately. The most serious flaw affects the update process itself, and the remaining flaws include stored XSS bugs that affect multi-author sites. Backported fixes are available for all supported branches down to version 4.7.

What is the WordPress 7.1.4 RCE vulnerability? It is a race condition in the core upgrade process, reported by researcher Umut Bayram. During an update, temporary files could be exposed in the wp-content/upgrade/ directory; an attacker hitting the exposed installer at the right moment could run setup with their own database and gain code execution. Exploitation needs precise timing and is rated difficult, but the fix is free and immediate.

Does WordPress 7.1.4 update automatically? Sites with automatic background updates enabled should begin updating automatically. Otherwise, update manually from Dashboard > Updates. WordPress has not reported any active exploitation of these flaws, but recommends not waiting.

Takeaway: WordPress 7.1.4 is a small release with an outsized reason to install it: the worst flaw was in the updater itself. Update today, confirm the version number, and tighten who can publish on your site.

Follow World Tech on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

TechByCountry — Daily Tech News, Country by Country

Search This Blog