WordPress 7.1.4 fixes 13 security issues (October 2026)
WordPress 7.1.4, released on October 28, 2026, is a security release that fixes 13 issues, including a flaw in the update process that could allow code to run on the server. WordPress recommends updating immediately. Most sites update themselves; check yours shows 7.1.4, or the matching fix for an older branch.
- Date
- Severity
- High
- Status
- Act now
- Who’s affected
- WordPress sites on any version before 7.1.4. Older branches back to 4.7 get matching fixes; 4.6 and older get none.
What to do
- Check that your site shows WordPress 7.1.4, or the matching fix for its branch (for example 6.9.11 or 6.8.12).
- If it hasn't updated, back up and update from Dashboard, then Updates.
- Review who has Contributor or higher roles; most of the other fixed issues start from a signed-in account.
- If your site is several major versions behind, plan a move to the current release.
What happened?
On October 28, 2026, WordPress released version 7.1.4, a security release. The release post lists 13 fixes and recommends updating immediately. Fixes were also sent back to every older branch still getting courtesy security updates, which goes back to 4.7.
The most serious fix is for a weakness in the update process. It could let an attacker run code on the server during the short window while an update is running. Patchstack’s write-up rates it hard to exploit in practice, because the timing has to be exactly right. Most of the other issues are stored cross-site scripting bugs in blocks and the Customizer, which mostly need a signed-in account with Contributor access or higher.
Who’s affected?
Every WordPress site on a version before 7.1.4, or before the matching fix for its branch. Sites on WordPress 4.6 or older get no fix at all.
Most sites install minor releases like this on their own. WordPress’s release post says sites with automatic background updates will begin updating automatically. Sites where automatic updates are turned off, or blocked by the host or a plugin, need someone to do it.
Is it being attacked?
Neither WordPress.org nor Patchstack reported active attacks when the release came out. That can change quickly once fixes are public, which is why the advice is to update now rather than wait.
What should I do?
- Check your version. Look at the At a Glance box on the Dashboard. See whether your site is on an old PHP or WordPress.
- If it isn’t 7.1.4, take a backup and update from Dashboard, then Updates. If you’re on an older major version, the update screen offers the fix for your branch.
- Check your users. Remove accounts that no longer need access, and lower roles where you can.
- If you’re several major versions behind, you’re relying on courtesy fixes. Read how WordPress releases work and plan the move.
How does E-3 handle this?
On sites we look after through website care, WordPress updates are tested on a staging copy first, with daily backups. Monitoring tracks waiting updates on each hosted site, and we send security alerts.
Rather we handled security updates for you?
It’s part of what we do every week for small businesses, as part of website care. Start with a free check of your site and profile, or call and ask.