WordPress 7.1.4 fixes 22 flaws, including upgrade RCE
Original title: WordPress 7.1.4 Security Release
The unauthenticated race needs a seconds-long update window and a web-reachable wp-content/upgrade directory; backports reach 4.7.39.
WordPress 7.1.4, released October 28, 2026, fixes 22 vulnerabilities across 17 advisories, with same-day backports for supported branches down to 4.7.39. Most issues need a Contributor or higher account and can lead to stored cross-site scripting, including seven Interactivity API bugs. A race during core upgrades can yield remote code execution with no account if an attacker hits a brief window while wp-content/upgrade/ is reachable. Patchstack says that issue is not practical and a PHP firewall will not see the request.
Unconfirmed: Patchstack says the upgrade race is not practical because the attacker must hit a seconds-long window.
- 7.1.4 appends 16 random characters to the extraction folder name.
- The fix recreates index.php and stops copying wp-config.php out.
- Seven advisories share an Interactivity API data-* attribute root.
- One Interactivity bug hangs the visitor’s browser tab, not the server.
- Patchstack advises denying web access to wp-content/upgrade/.
Impact: Unauthenticated remote code execution during a core update
| Product | Affected | Fixed in |
|---|---|---|
| WordPress | supported branches before the 7.1.4 fixes, back through 4.7; Interactivity issues also listed for 6.4 and 6.5 | 7.1.4 and same-day backports down to 4.7.39 |
- 1.Upgrade supported WordPress branches to the 7.1.4 security backports.
- 2.Deny web access to wp-content/upgrade/ and confirm it is not listable.
- Vendors
- WordPress
- Organizations
- PatchstackAwesome Motive
From the original article
6 min read at patchstack.com
WordPress 7. 1. 4 came out on 28 October 2026 with fixes for what WordPress counts as 22 vulnerabilities across 17 advisories.
By Dave Jong · patchstack.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.