WordPress 7.1.4 is out, and it's one to install
WordPress 7.1.4 was released on 28 October 2026 as a security-only update. It is the fourth point release since the 7.x series moved on to 7.1 "Mary Lou" in August, and it is the largest of them by some distance: according to Patchstack's analysis, it fixes 22 vulnerabilities grouped into 17 advisories.
There are no new features in this release, only fixes. Here's what it addresses, who it matters to, and what you should do about it.
The headline fix: a weakness in the update process itself
The most significant issue is, somewhat ironically, in the mechanism WordPress uses to update itself. During a core update, WordPress unpacked the new files into wp-content/upgrade/ under a predictable folder name, and a clean-up step removed the index.php file that normally prevents that folder from being browsed. For a few seconds, a complete copy of WordPress, including its installer, sat at a guessable web address.
An attacker who reached it within that window could, in theory, run the installer against a database they controlled and gain code execution on the server. No login is needed, but the attack relies on precise timing and on wp-content/upgrade/ being reachable from the web. Patchstack rated the attack complexity as high. 7.1.4 closes the gap by adding a random string to the folder name and keeping the protective index.php in place.
It's a good illustration of why server configuration matters as much as the software running on it: a host that already blocks public access to wp-content/upgrade/ was never exposed to this one.
The other fixes
The remaining issues mostly require someone to be logged in, which makes them less urgent for a single-author brochure site and more relevant to sites with several contributors, memberships, or shop staff accounts:
- Stored cross-site scripting (XSS) in the Interactivity API and in the Comments Pagination and Post Navigation Link blocks, exploitable by a user with Contributor access or above. Further XSS issues needed Author or Editor access.
- Customizer preview leak: unpublished Customizer changes could be seen by logged-out visitors.
- Notes permissions: custom roles able to moderate comments could read, edit, and delete editorial notes on posts they had no permission to edit.
- Denial of service in Interactivity API bindings, which could hang a visitor's browser tab (not the server).
- Updated root certificates following the revocation of the eMudhra certificate authority, plus two general hardening changes.
Running an older version? You still get the fixes, if you update
The WordPress security team has backported these fixes to every branch back to 4.7, so a site on 7.0 should move to 7.0.8, a site on 6.9 to 6.9.11, and so on. WordPress 4.6 and earlier receive no security updates at all. If your site is that far behind, it's no longer a question of applying a patch; it needs a proper upgrade plan.
It's also worth keeping 7.1.4 in context. Since 7.1 shipped on 19 August, there have been four point releases containing 41 security fixes between them, and the single critical vulnerability fixed in 7.1.2 was reportedly being exploited within hours of release. The gap between a fix being published and attackers using it is now measured in hours, not weeks.
What to do now
- Update to 7.1.4 (or the latest release on your branch) via Dashboard › Updates. Take a backup first.
- Check automatic updates actually ran. Minor releases normally apply automatically, but it is common to find sites where they've been disabled by a plugin, a host, or a well-meaning developer years ago.
- Ask your host whether
wp-content/upgrade/is blocked from public access. - Review user accounts. Most of these fixes involve logged-in users, so remove accounts that are no longer needed and make sure nobody has a higher role than they require.
If you're on one of our Care Plans or hosting packages, this has already been done for you: 7.1.4 has been applied and checked across the sites we manage, and our servers block web access to the upgrade directory as standard.
What's next: WordPress 7.2
WordPress 7.2 is currently in beta, with the final release scheduled for 8 December 2026. As with any major release, we'll test it on staging before rolling it out to client sites, and we'll cover what's new when it lands.
Summary
WordPress 7.1.4 is a security-only release fixing 22 vulnerabilities, the most notable being a timing-based weakness in the core update process. None of it changes how your site looks or works, so there is very little reason to wait. Update, confirm automatic updates are running, and tidy up user accounts while you're there.
