WordPress 7.1.4 patches 22 flaws, including an upgrade-window RCE
Original title: WordPress 7.1.4 Security Update Patches 22 Vulnerabilities Affecting Millions of Websites
Supported branches should install 7.1.4 or the matching legacy release; the advisory assigns no CVE IDs or scores.
WordPress released 7.1.4 on October 28, 2026, fixing 22 vulnerabilities in core, including a race condition during core updates that could lead to remote code execution. Other fixes cover stored cross-site scripting, information disclosure, authorization weaknesses, and Interactivity API issues reachable by Contributor-level accounts or higher. The advisory does not say whether the upgrade-window flaw has been exploited. Administrators should install the matching patched release rather than wait for WordPress 7.2, scheduled for December 8, 2026.
Unconfirmed: The advisory does not say whether the upgrade-window RCE has been exploited.
- Umut Bayram reported the race condition in the core upgrade window.
- WordPress 7.0.8 and 6.9.11 address all 22 issues.
- Releases 6.8.12 and 6.7.11 fix the 20 issues affecting those branches.
- Patched legacy releases extend down to 4.7.39, with different fix subsets.
- Anthropic reported an editor-level stored XSS tied to personal-data erasure requests.
Impact: Possible remote code execution during core updates, plus stored XSS
| Product | Affected | Fixed in |
|---|---|---|
| WordPress | legacy branches down to 4.7.39, with branch-specific subsets | 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11 |
- 1.Install WordPress 7.1.4, or the patched release for the site's branch.
- 2.Verify that automatic background updates actually completed.
- 3.Do not defer fixes until WordPress 7.2, scheduled for December 8, 2026.
From the original article
2 min read at gbhackers.com
WordPress has released version 7. 1. 4 to address 22 vulnerabilities, including issues related to remote code execution, stored cross-site scripting, information disclosure, and authorization weaknesses.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.