WordPress has released version 7.1.4, a security update that fixes 22 vulnerabilities across 17 advisories, the platform announced on 28 October 2026. Backports were issued the same day for every supported branch, reaching back as far as version 4.7.39, so even very old sites still receiving security support can apply the fixes. The release contains no new features: it exists solely to close security gaps, and site owners are urged to update promptly.

Most flaws need a login, but one does not

The most serious issue is a race condition in the WordPress upgrade process itself, which researchers say could allow remote code execution during the update window without any account at all. The remaining flaws are mostly stored cross-site scripting problems in the Interactivity API, the Customizer and several blocks, and almost all of them require at least a Contributor-level account before they can be used. One further flaw exposed unpublished Customizer changes to visitors who were not logged in, while another let some privileged users read notes on posts they could not edit.

What site owners should do now

No exploitation in the wild has been reported for these flaws in the sources checked, and the WordPress announcement does not claim any attacks took place. That is not a reason to delay, however, because security releases of this kind are closely studied by attackers once the fixes are public. Owners should update to 7.1.4 or the matching backport, confirm automatic updates are working, and audit Contributor accounts, removing logins belonging to former staff or freelancers who no longer need access.

Sources: WordPress.org, Patchstack, Search Engine Journal.