Do Son 
TL;DR
WordPress 7.1.4 shipped on October 28, 2026, with fixes for 17 security issues. This WordPress security release also updates the bundled root certificates after the eMudhra revocation. The WordPress team says, “it is recommended that you update your sites immediately.”
The update patches a race condition that could lead to remote code execution, plus ten stored cross-site scripting (XSS) bugs. Most XSS flaws need at least Contributor access. Update to WordPress 7.1.4 now, or confirm that automatic updates have applied it.
Why It Matters
Core bugs affect every WordPress site that has not updated. Stored XSS flaws let a low-privileged user plant scripts that run in an admin’s browser. As a result, a single rogue contributor account could become a path to site takeover.
How the Attack Works
Remote code execution
The most serious fix covers “a race condition during core updates that could lead to remote code execution,” reported by Umut Bayram. WordPress has not shared further technical details.
Interactivity API and other XSS bugs
Six fixes target the Interactivity API. They include XSS through javascript: URLs, event handler bindings and prototype pollution in context namespaces. Other XSS bugs hit Customizer selective refresh, block delimiters and the personal data erasure screen.
Information disclosure
Another fix stops “unpublished Customizer changes” from leaking to unauthenticated visitors. Anthropic reported two of the issues, including the data erasure XSS.
Affected Versions
All WordPress versions before 7.1.4 lack these fixes. WordPress is backporting them to every branch back to 4.7. However, those backports “will ship as they become ready.”
Patch and Mitigation
Install this WordPress security release from the dashboard. Also, review user roles and remove unneeded Contributor or Author accounts. So far, no exploitation in the wild has been reported, and no CVE IDs have been published. See the official WordPress 7.1.4 security release announcement for the full list.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
