WordPress 7.1.4: 22 security fixes, and one attackers are already probing

On 28 October 2026, WordPress released version 7.1.4, a security release that fixes 22 vulnerabilities in WordPress itself. Most need someone with an account on your site to exploit them. One doesn’t: a flaw in the WordPress updater that can let an outsider run code on your server, and security firm Wordfence says attackers started probing for it the same day. Here’s what was fixed, which sites are most exposed, and how to make sure yours is patched.

The short answer

• Update to WordPress 7.1.4, or the fixed release for your branch if you’re on an older one (see the table below).
• Check, don’t assume. WordPress installs security releases automatically by default, but hosts, plugins or developers sometimes switch that off.
• Sites with several authors, contributors or vendors gain the most from this update. Many of the fixes stop people with lower-level accounts from injecting harmful code.
• If you use Wordfence, make sure its Extended Protection is turned on.

What 7.1.4 fixes

The WordPress security team credits a long list of researchers for the 22 fixes. In plain terms, they fall into a few groups:

• Stored cross-site scripting (XSS). Most of the fixes. These let a logged-in user, from Contributor up depending on the flaw, save content that runs harmful code in the browser of anyone who views it, including administrators. Many involve blocks and the Interactivity API.
• Information disclosure. One flaw exposed unpublished Customizer changes to visitors who weren’t logged in.
• Permissions. Custom roles that moderate comments could read, edit and delete notes on posts they can’t edit.
• Denial of service issues in the Interactivity API.
• The updater race condition, covered next.
• Hardening and housekeeping, including updated root certificates after the eMudhra certificate revocation.

The updater flaw attackers are probing

The most serious fix closes a race condition in the WordPress core update process, reported by researcher Umut Bayram. According to Wordfence, it affects WordPress 4.7 through 7.1.3, needs no login, and is rated 8.1 out of 10 for severity.

In simple terms: while WordPress installs a core update, it briefly unpacks files into a temporary folder. If the server lets those files run and an attacker requests them at exactly the right moment, the attacker can run code on the server. That window is short (Wordfence found it normally lasted only seconds in testing), so attacks are hard to pull off, but not impossible.

Wordfence reports exploitation attempts since 28 October and hasn’t reported a confirmed compromise. WordPress fixed it by randomising that temporary folder and adding extra safeguards around it.

Which sites are most at risk

Every WordPress site should update. Two kinds of site have extra reason to do it today:

• Sites where other people can log in and write. Membership sites, online communities, multi-author blogs and marketplaces where vendors add their own products all give accounts to people you don’t fully control. Most of the cross-site scripting fixes stop exactly those accounts from planting harmful code that runs when an administrator views it. If you run a community or membership site, this update matters more than usual.
• Sites that aren’t updating automatically. The updater flaw affects any site still on 7.1.3 or earlier (back to 4.7), whether or not anyone else can log in.

Is your version patched?

WordPress fixed these issues in every branch back to 4.7, but older branches only get the fixes as a courtesy: only the latest version is actively supported. Find your branch and check you’re on the fixed release or newer.

Older branches are affected by fewer of the fixes because the code involved didn’t exist yet. That isn’t a reason to stay on them: they miss years of other improvements, and the newest themes and plugins stop supporting them.

How to check and update

1. Log in to WordPress and go to Dashboard › Updates. The page shows your current version and whether a newer one is available.
2. Look for the line saying the site is automatically kept up to date with maintenance and security releases. If it isn’t there, automatic security updates are off, so ask your host or developer why.
3. Back up the site before updating, including files and database.
4. Click Update to version 7.1.4. Once it finishes, check the front of the site, your forms and, if you have one, your checkout.

If your site has to stay on an older branch for a theme or plugin that isn’t compatible yet, make sure it’s on that branch’s fixed release from the table, and plan the move to 7.1.

Worth doing while you’re there

• Wordfence users: turn on Extended Protection in the firewall settings. Wordfence says attacks on the updater flaw request files directly without loading WordPress, so the firewall needs to run before WordPress does. Its paid customers received a firewall rule for this flaw on 28 October.
• Ask your host whether PHP files can run from WordPress’s temporary and upload folders. The updater flaw depends on the server running files it shouldn’t. Blocking that is good practice anyway.
• Review who can log in. Remove accounts that are no longer needed and give people the lowest role that lets them do their job. Most of these fixes are about what lower-level accounts could do.
• Update plugins and themes too. A patched WordPress core doesn’t fix a vulnerable plugin.

Three security stories in two weeks

This update follows a critical PHP security fix and the UpdraftCentral breach, both in the last fortnight. None of them needed anything clever from site owners: they needed someone to notice, check each site and act quickly. That’s the real case for having someone look after your site.

If I already look after your site

WordPress core updates are part of my maintenance plans, so sites on one of them are covered.

How I can help

1. Free WordPress security check. I check your WordPress version, whether automatic security updates are on, and anything obviously out of date. You get a plain-English answer within one business day.
2. Update and hardening. I back up the site, bring WordPress, plugins and themes up to date, test that everything still works, and tighten the settings above. You get a fixed quote before any work starts, with no hidden fees.
3. Ongoing care. My website maintenance and care plans cover updates, backups, security and alerts like this one, so you don’t have to follow the security news yourself.

Sources

• WordPress.org: Version 7.1.4 release notes
• Wordfence: WordPress 7.1.4 security release