WordPress 7.1.4, released on 28 October 2026, is a security release that fixes 22 vulnerabilities, and site owners are advised to update immediately. The headline flaw is an unauthenticated race condition in the core upgrade process that could lead to remote code execution during the brief upgrade window. Wordfence rates that flaw CVSS 8.1, and no CVE identifier was assigned in the official release post.

What else was fixed

Most of the remaining fixes address stored cross-site scripting and Interactivity API issues, alongside an unpublished Customizer disclosure, a Notes permissions issue, and a bundled root-certificate update following the eMudhra revocation. Fixes have been backported through version 4.7, including 7.0.8 and 4.7.39. Only the most recent WordPress version is actively supported, and versions 4.6 and earlier no longer receive security updates.

How this differs from the recent attack surge

This is an update guide for 7.1.4 itself, not a fresh report of the attack surge covered in DailyByte's earlier article on the same flaw, which reported Wordfence blocking tens of thousands of attempts in the first day after the flaw became known. That surge and this release concern the same vulnerability, so readers should not treat the two as separate flaws. The next major release, WordPress 7.2, is planned for 8 December 2026, and its Beta 3 already contains all applicable fixes. Site owners should check Dashboard > Updates, apply 7.1.4 (or the backported fix for their branch), and confirm the version number afterwards.

Sources: WordPress.org release announcement; WordPress.org version 7.1.4 documentation. Related DailyByte coverage: WordPress RCE flaw attack surge.