WordPress 7.1.4 security update fixes 22 vulnerabilities
WordPress 7.1.4 was released on October 28, 2026, with 22 security vulnerabilities addressed. The fixes span cross-site scripting, information disclosure, permissions, the Interactivity API, and a race condition during Core updates that could lead to remote code execution.
What does WordPress 7.1.4 fix?
The official release documentation includes multiple stored cross-site scripting (XSS) vulnerabilities. Several require a logged-in Contributor, Author, or Editor account, but others involve different conditions. Affected areas include block markup, Customizer selective refresh, post navigation labels, and Interactivity API bindings.
Other fixes address unpublished Customizer changes being exposed to unauthenticated visitors, permissions for editing Notes, username output on multisite screens, and the Core update process. The release also refreshes the bundled root certificate list following the eMudhra revocation.
What we found in the WordPress Core Git diff
We compared the public 7.1.3 and 7.1.4 tags in the WordPress wordpress-develop repository. Beyond the release notes, several implementation changes are particularly useful to understand.
1. Core updates now use unpredictable working directories
WordPress previously derived the temporary extraction directory from the package filename. The updated upgrader adds a random suffix to that directory name and places an index.php file in the upgrade folder to discourage directory listing. During Core updates, wp-config.php is now explicitly excluded from files copied out of the working directory.
These are meaningful safeguards around the update workflow and align with the race-condition security issue documented in the release. They are not a reason to attempt manual workarounds: installing the patched Core release is the supported fix.
2. Interactivity API and HTML sanitization are more restrictive
The Interactivity API now limits which attributes can be dynamically bound on HTML object elements. WordPress also extends its KSES sanitization checks to reject bindings that could replace a restricted attribute value after the original content was validated.
This matters for themes and custom blocks that use interactive directives: security-related changes can alter how unsafe bindings are handled. Developers should test any custom Interactivity API functionality after upgrading.
3. Customizer previews and editorial permissions were tightened
The Customizer no longer automatically loads the latest unpublished changeset for users who lack the customize capability. The REST API also tightens permission checks for Notes so comment-moderation privileges do not automatically grant editing access to Notes on posts the user cannot edit.
4. Additional hardening affects blocks and user-facing HTML
The diff replaces some regular-expression-based HTML modifications in the Image and Playlist blocks with WordPress HTML Tag Processor handling. It also changes how block delimiters interpret whitespace and adds output escaping around user names in several administration screens.
The bundled Twenty Twenty theme is updated to version 3.3 as part of this release. The WordPress documentation lists no separately revised WordPress packages.
Older versions also need attention
WordPress says versions 7.0 and 6.9 were affected by all 22 vulnerabilities, and has released security backports for affected branches down to WordPress 4.7. The corresponding fixed releases include 7.0.8 and 6.9.11. WordPress 4.6 and earlier no longer receive security updates.
Backports are useful for sites that cannot immediately move to the latest major release, but they should not be mistaken for long-term active support of every older branch.
What website owners should do now
- Confirm backups include both files and the database, especially on WooCommerce sites.
- Update WordPress Core to 7.1.4, or install the relevant patched backport where an older branch is intentionally maintained.
- Check the installed version instead of assuming an automatic update succeeded.
- Test the site: login, page editing, forms, navigation, and any custom blocks or Customizer integrations.
- For ecommerce, test the full transaction path: cart, checkout, payment, order creation, emails, and subscriptions where applicable.
An unpatched version does not prove that a site was compromised. Equally, updating does not remove a pre-existing infection. If you find suspicious redirects, unknown users, altered files, or other warning signs, see our WordPress compromise checklist.
The practical takeaway
WordPress 7.1.4 is a high-priority security update. The public Git history shows concrete hardening in the updater, HTML sanitization, Interactivity API, user permissions, and Customizer. Update first, then verify that the important parts of your site still work.
FAQ
Is WordPress 7.1.4 a security update?
Yes. WordPress 7.1.4 was released on October 28, 2026 and addresses 22 reported security vulnerabilities. Updating affected installations promptly is recommended.
Does WordPress 7.1.4 fix a remote code execution issue?
Yes. The release notes identify a race condition during Core updates that could lead to remote code execution. The Core diff hardens how update working directories are created and which files are copied.
Are older WordPress versions affected?
Yes. Security fixes were also backported to affected older branches, including WordPress 7.0.8, 6.9.11, and other patched releases down to the 4.7 branch. WordPress 4.6 and earlier no longer receive security updates.
Will updating WordPress remove an existing infection?
No. Updating fixes the known Core vulnerabilities, but it does not automatically remove malware, unexpected accounts, malicious files, or other persistence that may already be present.
Need help with a security update or suspicious website behavior?
Webtaculos helps with WordPress updates, broken production workflows, security investigations, and recovery when there are actual signs of compromise.