WordPress 7.1.4 was released on October 28, 2026, addressing a total of 22 security vulnerabilities. Among the most serious issues is a flaw that could allow remote code execution during the WordPress update process. The WordPress security team strongly recommends that all website administrators install the update immediately.
This security release addresses a wide range of vulnerabilities, including multiple stored Cross-Site Scripting (XSS) issues, access control weaknesses, and other security risks. Several vulnerabilities affect the WordPress block editor and Interactivity API, which is used to create interactive website functionality.
Remote code execution vulnerability among the most serious issues
One of the most significant fixes in WordPress 7.1.4 addresses a weakness in the core update process. Security researcher Umut Bayram discovered a race condition that could potentially lead to remote code execution (RCE) during the update window.
Such vulnerabilities can be particularly dangerous because successful exploitation may allow attackers to execute malicious code on a server under certain conditions.
The release also fixes numerous stored XSS vulnerabilities that could allow malicious JavaScript to be stored within website content and subsequently executed in other users’ browsers, potentially including those of website administrators.
Multiple vulnerabilities affect WordPress blocks and the Interactivity API
A substantial number of security fixes target the WordPress Interactivity API, which provides functionality for building interactive website components.
The identified vulnerabilities include issues involving JavaScript execution, prototype pollution, and stored denial-of-service (DoS) conditions.
Additional security fixes address vulnerabilities affecting the Categories, Image, Playlist, Comments Pagination, and Post Navigation blocks.
Other improvements resolve weaknesses related to username handling, the exposure of unpublished Customizer changes, and permissions that could allow certain user roles to access notes attached to posts they are not authorized to edit.
Several vulnerabilities were reported by artificial intelligence company Anthropic, while independent security researchers and members of the WordPress Security Team also contributed to identifying and resolving the issues.
Security fixes also released for older WordPress versions
The security improvements introduced in WordPress 7.1.4 are not limited to the latest version. The development team has also released fixes for older WordPress branches.
For example, WordPress 7.0 and 6.9 were affected by all 22 vulnerabilities. Updates 7.0.8 and 6.9.11 have been released to address these issues.
Security updates are also available for several WordPress 5.x and 4.x branches, going back to version 4.7. However, WordPress 4.6 and earlier versions no longer receive security updates.
The WordPress development team emphasizes that only the latest WordPress version is actively supported.
Website administrators should update WordPress immediately
Given the number and potential severity of the vulnerabilities addressed, WordPress recommends installing version 7.1.4 as soon as possible.
The update can be installed through the WordPress administration panel under Dashboard → Updates. Websites with automatic background updates enabled may receive the new version automatically.
Before updating, administrators should ensure that a recent backup is available. After installation, it is advisable to verify that the website, installed plugins, and theme continue to function correctly.
The next major WordPress release, version 7.2, is currently scheduled for December 8, 2026.
