The WordPress team released WordPress 7.1.4 on October 28 and recommends updating every website immediately. The version closes 22 security vulnerabilities. Sites with automatic updates enabled will receive the update without any action on your part; all others you update by hand.
Which security vulnerabilities does WordPress 7.1.4 close?
The largest share consists of flaws through which attackers can inject malicious code into content: persistent cross-site scripting (XSS). The code then sits in a post, for example, and runs in the browser of everyone who opens the post. Affected are, among others, the Categories, Image and Playlist blocks, the blocks for paging through comments, the Customizer and the Interactivity API, the interface for interactive blocks.
For most of these vulnerabilities, an attacker needs a user account with at least the Contributor role, and for some the Author or Editor role. For some flaws, an editor or administrator must additionally open the manipulated content in the backend, as the security company Patchstack describes in its analysis.
Two flaws can be exploited without logging in. Visitors were able to see unpublished changes from the Customizer. More serious is a vulnerability in the update process: WordPress unpacks the update package into the wp-content/upgrade/ folder, and for the few seconds of an update, a complete installation sits there at a guessable address. In the worst case, code can be executed on the server this way. Patchstack rates the attack as difficult because the request has to succeed in exactly this time window.
Which update do you need for older versions?
The team has backported the fixes to all older version series up to and including 4.7, even though officially only the latest version is maintained. The version page in the WordPress documentation lists how severely each series is affected: All 22 vulnerabilities are also present in 7.0 and 6.9, fixed in 7.0.8 and 6.9.11. For 6.8 with 20 vulnerabilities, 6.8.12 was released; for 6.5 and 6.4 with 17 vulnerabilities each, versions 6.5.14 and 6.4.14 were released. Version 4.7 still contains two of the vulnerabilities, fixed in 4.7.39. Version 4.6 and older no longer receive security updates.
Which update for which version?
WordPress released the fixes on October 28, 2026 for all series from 4.7 onward.
Your version seriesUpdate to
- WordPress 7.17.1.4
- WordPress 7.07.0.8
- WordPress 6.96.9.11
- WordPress 6.86.8.12
- WordPress 4.74.7.39
Version 4.6 and older no longer receive security updates
Sources: WordPress.org News, WordPress.org Documentation
The fixes are also included in the third beta of WordPress 7.2, which is due to be released on December 8.
What this means for you
Under Dashboard > Updates you can see which version your site is currently using. If none of the mentioned fix versions is listed there yet, it is best to update by hand right away. If your host takes care of WordPress updates, ask them whether 7.1.4 has already been installed. For sites running version 4.6 or older, the only option is to move to a current series.
Since most of the vulnerabilities require an account, it is worth taking a look under Users > All Users. Accounts of guest authors, former team members or customers with the Contributor, Author or Editor roles that nobody needs anymore are best deleted or downgraded to Subscriber.
It is best to block the update folder directly on the web server. Patchstack advises denying access to wp-content/upgrade/ there; a PHP-level firewall, as many security plugins include, cannot stop this attack. To test, open your site's address with the addition /wp-content/upgrade/ in the browser. If a file list appears, ask your host to lock down the directory. Basics on securing your site are explained in the lesson on security and backups in the course "WordPress for Beginners".
WordPress released version 7.1.4 on October 28, 2026.
Sources
