WordPress 7.1.4 fixes upgrade RCE and multiple stored XSS bugs
Original title: WordPress 7.1.4
Fixes are being backported through the 4.7 line, and automatic background updates should install 7.1.4.
WordPress released 7.1.4, a short-cycle security update that site owners are told to install immediately. Reported issues include remote code execution during the upgrade window, several stored cross-site scripting bugs, a stored denial of service in the Interactivity API, and discovery of unpublished customizer changesets by unauthenticated users. Bundled root certificates were updated after the eMudhra revocation. Backports through the 4.7 branch are in progress, and WordPress 7.2 Beta 3 includes the applicable fixes.
- A weakness in the upgrade process can yield remote code execution during that window.
- Stored XSS reports cover blocks, Customizer, Categories, Playlist, and comment pagination.
- Unauthenticated users can discover unpublished customizer changesets, the release says.
- WordPress 7.2 is planned for December 8; Beta 3 already includes applicable fixes.
Impact: remote code execution during upgrades and stored XSS
| Product | Affected | Fixed in |
|---|---|---|
| WordPress | — | 7.1.4 |
- 1.Update sites to WordPress 7.1.4 immediately
From the original article
2 min read at wordpress.org
This security release features fixes for multiple issues. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.
By Aaron Jorbin · wordpress.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.