WordPress 7.1.4 Fixes 22 Security Flaws, Including RCE

WordPress 7.1.4 fixes 22 security flaws, including an Unauthenticated RCE Vulnerability in the software update process. WordPress released the security update on October 28, 2026, and urged website owners to install it immediately.

The unauthenticated RCE vulnerability could let an attacker run code without a WordPress account. Exploitation depends on reaching a temporary installer during a brief update window, when files are being extracted into the publicly accessible wp-content/upgrade/ directory.

How the Unauthenticated RCE Vulnerability Worked

Before the unauthenticated RCE vulnerability fix, predictable temporary folder names and cleanup that removed index.php could expose an unpacked WordPress installer. An attacker who reached that installer at the right moment could run setup with a database under the attacker’s control, creating a path to code execution.

WordPress 7.1.4 changes the update process in three ways. It adds 16 random characters to temporary folder names, restores index.php protection, and prevents wp-config.php from being copied from the working directory. The source report says the timing window lasts only seconds, and Patchstack rates exploitation as difficult.

The release addresses 22 flaws across 17 advisories, according to Patchstack’s technical analysis. Those figures count different things: the advisories are reports, while 22 is the total number of vulnerabilities fixed. The update also covers stored cross-site scripting, data exposure, access control issues and a denial-of-service problem that could freeze a visitor’s browser tab.

More WordPress Security Fixes

Several changes affect the Interactivity API, which supports interactive page features. Contributors could save crafted attributes that passed content filtering and later triggered unsafe browser actions. WordPress says the update blocks dangerous bindings and strengthens checks.

Other stored cross-site scripting fixes cover crafted block markup, Customizer selective refresh, Categories and navigation labels. Image and Playlist processing also received hardening. Stored cross-site scripting occurs when harmful script content remains saved and runs when another user opens the affected content.

Anthropic reported issues involving personal data removal requests and specially crafted usernames. A separate Customizer flaw exposed unpublished changes to visitors without accounts. WordPress also tightened note permissions, preventing users from accessing notes attached to posts they cannot edit.

The scope connects to earlier coverage of WordPress security work and a separate WordPress vulnerability. Those reports concern other developments; they do not describe this update’s flaws. For broader hosting security coverage, readers can also see a LiteSpeed server flaw affecting shared hosting.

Install the Update and Confirm the Version

Administrators can install WordPress 7.1.4 from Dashboard, Updates, and Update Now, or download the release. Sites with automatic background updates should receive it automatically, but owners should confirm the installed version instead of assuming the update completed.

The official version documentation lists patched older branches, including 7.0.8, 6.9.11 and releases extending to 4.7.39. The source says not every branch contains all 22 fixes, and only the latest WordPress version remains actively supported. Versions 4.6 and earlier receive no security updates.

Patchstack recommends blocking web access to wp-content/upgrade/ at the web server and reviewing accounts with Contributor privileges or higher. A WordPress plugin firewall may not protect the extracted installer because that copy loads independently. WordPress 7.2 is scheduled for December 8, but the source advises site owners not to delay this security update while waiting for that release.