On October 28, 2026, the WordPress team released version 7.1.4. It is a security release that fixes 22 vulnerabilities. The most serious is a race condition during core updates that can lead to remote code execution (RCE). The rest are mostly XSS flaws, including several in the new Interactivity API. WordPress recommends updating immediately. Check whether your site has already updated itself, because this release is also meant for automatic background updates.
The most important one: a race condition during core updates
The team describes it as a race condition during core updates that could lead to RCE. It was reported by Umut Bayram. The official announcement gives no CVE number and no required privileges, and it refers to an "upgrade window". The code changes touch files such as class-wp-upgrader.php and update-core.php. There are no more technical details, so judge this carefully: treat the flaw as serious until a full write-up exists.
Unlike the critical flaw in 7.1.2 (CVE-2026-87902), there is no confirmed way to attack this without logging in, but there is also no confirmation that there is none. Updating is the only sensible step.
The other fixes
Below is the list from the official release page. The WordPress.org announcement groups some of them together, and the official count is 22.
Requiring a Contributor account or higher
- Stored XSS via whitespace in block delimiters (Rafie Muhammad, Awesome Motive).
- Stored XSS in Customizer selective refresh (Rafie Muhammad).
- Stored XSS via
javascript:URLs in Interactivity API bindings (Luis Herranz and other reporters). - Stored XSS via event handler bindings in the Interactivity API (Jon Surrell).
- Stored XSS via prototype pollution in Interactivity API context namespaces (rekter0).
- Stored XSS and denial of service (DoS) in Interactivity API bindings (rekter0, Marcel Karlsson, Jon Surrell, Alex Concha).
objectelements in Interactivity API bindings could load admin pages (rekter0).- Stored XSS in the labels of the Comments Pagination and Post Navigation Link blocks (Alex Concha, WordPress Security Team).
Requiring an Author or Editor account
- Author+: stored XSS in the Interactivity Router via uploaded text files (Anas Cherni).
- Editor+: stored XSS on the personal data erasure requests screen (reported by Anthropic).
No stated privilege level, or other
- Unpublished Customizer changes visible to unauthenticated visitors (information disclosure, Antonio Lorensius Silaban).
- Format string injection in the Categories block, leading to XSS (Ben Bidner).
- Custom roles with comment moderation permissions could read, edit and delete notes on posts they cannot edit (Ramon, WordPress Security Team).
- Post content could shadow Script Module data through a matching element ID (Weston Ruter).
- Hardening: unescaped usernames on the multisite Network Users screens (reported by Anthropic), and unsafe
preg_replace()replacements in the Image and Playlist blocks (Ben Bidner). - Update of the bundled root certificates after the eMudhra revocation. This is not a bug in WordPress code.
The full list is in the 7.1.4 release documentation, and the announcement is on WordPress.org News. CVE numbers were not given in those documents, so we do not list any here.
Who is affected and which versions are fixed
WordPress backported the fixes to every branch eligible for security fixes, and only the latest version is actively supported. The number of affected flaws depends on the version:
| Your branch | Affected by | Safe version |
|---|---|---|
| 7.1 | 22 of 22 (per the announcement) | 7.1.4 |
| 7.0 | 22 of 22 | 7.0.8 |
| 6.9 | 22 of 22 | 6.9.11 |
| 6.8 | 20 of 22 | 6.8.12 |
| 6.7 | 20 of 22 | 6.7.11 |
| 6.6 | 19 of 22 | 6.6.11 |
| 6.5 and 6.4 | 17 of 22 | 6.5.14 / 6.4.14 |
| 6.3 to 5.9 | 9 of 22 | 6.3.14, 6.2.15, 6.1.16, 6.0.18, 5.9.20 |
| 5.8 to 5.0 | 6 of 22 | e.g. 5.8.19, 5.0.31 |
| 4.9 | 4 of 22 | 4.9.35 |
| 4.8 and 4.7 | 2 of 22 | 4.8.34 / 4.7.39 |
WordPress 4.6 and older no longer get security updates. For those versions there is nothing to update within the same branch, so you need to move to a newer one.
Why take it seriously even though most of it is XSS
- Stored XSS from Contributor level is not "just XSS". On sites with many authors, open registration or guest writers, an attacker can run a script in an administrator's browser and take over the account.
- The Interactivity API is a new part of core, and this release fixes several bugs in it. Watch for further releases.
- The flaw in the update process concerns the very mechanism that is supposed to protect you. Treat such bugs with the highest attention.
How to update safely
- Take a full backup of files and database, stored off the production server.
- Go to Dashboard → Updates → Update Now. Sites with automatic background updates turned on will update on their own. Check the version in the footer of the admin panel.
- If you have staging, update there first and check the theme, blocks, forms and the admin area.
- Until you update, limit Contributor and Author accounts to people you trust.
- After the update, check login, the block editor, the comment form, and in shops the cart and payments.
- Remember PHP: WordPress alone will not fix the PHP2Shell flaws. That needs a separate update on the server.
The next planned release is WordPress 7.2 (December 8, 2026). You can check any core version in our public WordPress vulnerability (CVE) database, no account needed.
Four patches in six weeks? You do not have to track them by hand
MonitorWWW.com checks your installed WordPress version against the known-vulnerability (CVE) database and sends an email, SMS or Telegram alert when your site has a known, unpatched security flaw.
Create a free accountSummary
WordPress 7.1.4 is the fourth security release of the 7.1 branch in under six weeks (7.1.1 to 7.1.4). The most important item is the flaw in core updates, but most of the other fixes are XSS issues reachable by ordinary authors. Update to 7.1.4, or to the fixed version of your branch, and then make sure nobody added new administrator accounts or unknown files.