WordPress 7.1.4 released: update now for multiple security fixes

WordPress.org published WordPress 7.1.4 on October 28, 2026, as a security release that fixes several vulnerabilities, and the project recommends updating sites right away. According to WordPress.org, this release includes a weakness in the upgrade process that can lead to remote code execution during the upgrade window and multiple stored cross-site scripting issues across blocks and APIs.

WordPress 7.1.4: what changed

The release page on WordPress.org lists the specific issues fixed in 7.1.4. Key items called out include:

• A weakness in the upgrade process that can lead to remote code execution during the upgrade window, reported by Umut Bayram.
• Multiple stored cross-site scripting issues (stored XSS) in block markup, the Interactivity API, Customizer selective refresh, Categories and Playlist blocks, image blocks, and comments pagination blocks, reported by several researchers and teams including Rafie Muhammad, Anthropic, AnC, DatNLQ from VietSunshine Cyber Security, rekter0, Anas cherni, Marcel Karlsson, and others from the WordPress Security Team.
• A stored denial of service issue in the Interactivity API, reported by Jon Surrell of the WordPress Security Team.
• An issue where unpublished customizer changesets could be discovered by unauthenticated users, reported by Antonio Lorensius Silaban.
• A case where specially crafted user logins could lead to stored XSS, reported by Anthropic.
• Notes attached to posts being readable by privileged users who do not have edit access to the post, reported by Ramon of the WordPress Security Team.
• An update to the bundled root certificates due to the eMudhra revocation.

WordPress.org also thanks a long list of contributors and researchers who responsibly reported these issues and helped get them fixed.

Who is affected and why it matters

According to WordPress.org, the issues include both stored XSS and a remote code execution pathway during upgrades. These classes of bugs are important to site administrators because, as the release notes say, they can allow attackers to inject malicious content or execute code under certain conditions. Because WordPress is widely used across small businesses, nonprofits, and public sector projects, the release page recommends updating as a priority.

The project calls 7.1.4 a short-cycle security release. WordPress.org notes that sites with automatic background updates enabled will begin the update process automatically. The release page also states that backports of these fixes are being prepared for eligible older branches, currently through version 4.7, and that backports will ship as they become ready.

WordPress.org also notes that WordPress 7.2 Beta 3 has been released with all applicable fixes from 7.1.4.

What to do now (practical steps)

• Update immediately: follow the update flow in your WordPress Dashboard by clicking Updates, then Update Now, or download 7.1.4 from the WordPress.org release page and apply it manually. WordPress.org says, "Because this is a security release, it is recommended that you update your sites immediately."
• Check automatic updates: if your sites support automatic background updates, confirm they are enabled and that updates completed successfully.
• Watch for backports: if you manage sites on older supported branches, monitor for the backports WordPress.org is preparing for eligible branches through 4.7 and apply them when available.
• Backup before changing: take a site backup (files and database) before applying updates so you can restore if you need to undo changes.
• Review post-update access: after updating, review who has privileged access on your site and check any components mentioned in the release notes (blocks and the Interactivity API) for unexpected behavior.

These steps follow the guidance and recommendations presented on the WordPress.org release page and reflect common safety practices for applying security updates.

Release management and support notes

The WordPress.org announcement names Aaron Jorbin and Nik Tsekouras as lead maintainers for the release and lists many contributors who reported or helped fix issues. The release page emphasizes that only the most recent version of WordPress is actively supported, and that the security fixes are being backported as a courtesy to eligible branches.

If you manage multiple sites, prioritize high-risk or public-facing sites first and schedule updates for other sites. For teams that prefer direct help, consider engaging a developer familiar with WordPress and form plugins for testing and deployment. If you want hands-on assistance, contact a Formidable Masterminds developer for support: Running WordPress or Formidable Forms? Get help from a Formidable Masterminds developer.

Final note

WordPress.org has published 7.1.4 to address a set of security issues and expressly recommends updating immediately. Follow the update instructions in your Dashboard or download the release from WordPress.org, verify backups, and monitor for backports to older supported branches as they become available.