WordPress 7.1.4 Security Release: 22 Fixes, Update Now

WordPress released version 7.1.4 on 28 October 2026, a security release with fixes for 22 vulnerabilities. The WordPress.org announcement recommends that you update your sites immediately. The list includes a race condition during core updates that could lead to remote code execution, an information disclosure that exposes unpublished Customizer changes to unauthenticated visitors, and a long run of stored cross-site scripting (XSS) issues, several of them in the Interactivity API. The same fixes were backported to every branch from 4.7 onwards, so even an old site has a patched release to move to.

What WordPress 7.1.4 fixes

The 7.1.4 release notes list the reported issues. Grouped by type:

• Remote code execution: a race condition during core updates that could lead to remote code execution, reported by Umut Bayram.
• Information disclosure: unpublished Customizer changes exposed to unauthenticated visitors, reported by Antonio Lorensius Silaban.
• Permissions: custom roles that moderate comments could read, edit and delete notes on posts they cannot edit, reported by Ramon of the WordPress Security Team.
• Stored XSS in the Interactivity API: several Contributor+ issues via bindings, javascript: URLs, event handler bindings and prototype pollution in context namespaces, plus an Author+ issue in the Interactivity Router via uploaded text files. A related Contributor+ issue let object elements in bindings load admin pages, and the bindings also had denial of service issues.
• Stored XSS elsewhere: Contributor+ issues via whitespace in block delimiters, in Customizer selective refresh, and in the labels of the Comments Pagination and Post Navigation Link blocks; an XSS in the Categories block via format string injection; and an Editor+ issue on the personal data erasure requests screen.
• Hardening and other fixes: escaping of usernames on the multisite Network Users screens and safer preg_replace() replacements in the Image and Playlist blocks, plus a fix for an issue that let post content shadow Script Module data with a matching element ID.
• Certificates: an update to the bundled root certificates after the eMudhra revocation.

"Contributor+" means an attacker needs at least a Contributor account on the site. That limits who can exploit many of these issues, but it matters on any site where people outside your team can write posts: multi-author blogs, membership sites, and stores that give agencies or freelancers editing access.

Fixed versions for every branch

WordPress says that only the most recent version is actively supported, but it released the fixes for older affected branches as a courtesy. The release notes give the number of the 22 vulnerabilities that affect each branch, and the releases page lists every fixed version as released on 28 October 2026:

WordPress 4.6 and earlier no longer receive security updates. A site on one of those versions has no patched release on its branch and needs a full upgrade.

How to update to WordPress 7.1.4

Since WordPress 3.7, minor core releases such as security releases install themselves through automatic background updates, and the WordPress upgrade guide says these are enabled by default on most sites. Do not assume yours updated, though: hosts, plugins and the AUTOMATIC_UPDATER_DISABLED constant in wp-config.php can switch them off.

1. Back up the site, files and database, so you can restore it if something breaks.
2. Update from the dashboard: go to Dashboard, then Updates, and click Update Now. WordPress.org also offers 7.1.4 as a download.
3. Or update from the command line: run wp core update with WP-CLI, which defaults to the latest version. To stay on an older branch and take only its security release, add --minor.
4. Confirm the version: run wp core version (WP-CLI docs) or check the Updates screen.
5. Check the core files: wp core verify-checksums (WP-CLI docs) compares your files against the WordPress.org checksums for your version.

If your host runs an old PHP version, the update screen is also a good moment to check it. Our guide to updating PHP in WordPress covers that, and the PHP2Shell vulnerability is a reason not to leave it. WordPress 7.1.4 is a short-cycle release; the next major version, 7.2, is planned for 8 December 2026.