WordPress 7.1.4 Patches 22 Vulnerabilities, Including a Remote Code Execution Flaw

WordPress 7.1.4 patches 22 vulnerabilities, including a remote code execution flaw tied to the update process itself. Here’s what you need to know about this new release.

On October 28, 2026, the WordPress team released WordPress 7.1.4, a new minor release entirely focused on security. “Since this is a security release, we recommend updating your sites immediately”, the announcement reads. Consider yourself warned from the start.

This release aims to fix 22 vulnerabilities, and branches 7.0 and 6.9 are affected by all of them. That could easily mean several million websites. Some flaws affect older versions, so patches are available for every WordPress release back to 4.7, which is updated to 4.7.39 (see the list on this page).

You’ve probably noticed that the 7.X branch has been shipping fixes one after another. WordPress 7.1.1 was released on September 17 (11 vulnerabilities fixed), WordPress 7.1.2 on September 22 to patch a critical-severity flaw, then WordPress 7.1.3 on October 6 with 7 security fixes. And now here we are with the fourth security update in six weeks. Not to mention this summer’s little gem: in July, the WordPress team patched the wp2shell flaw, a critical unauthenticated RCE in the WordPress Core.

So, what exactly is hiding in this new update?

A Hidden RCE in the Update Mechanism

The most serious security flaw is located in WordPress’s own update process: a race condition during the Core update could lead to remote code execution. The WordPress announcement says the risk concerns the time required to perform the update, without providing any further details.

This security bulletin also fixes vulnerabilities that can be exploited with a user account having the Contributor role, especially Stored XSS issues.

The exploitation conditions have not been made public at this stage, and no CVE identifier is mentioned in the bulletins.

The Interactivity API in the Spotlight

The Interactivity API component is affected by 6 vulnerabilities, but it is not the only one. Here is a summary of the other flaws patched by this update:

• Interactivity API : six flaws directly affect it. These include stored XSS via bindings (URLs using javascript:, event handlers, etc.), an issue that allows object elements to load admin pages, an XSS via text files uploaded in the Interactivity Router (Author role required), and a denial of service.
• Native blocks : stored XSS issues affect the Categories block (format string injection) as well as the labels of the Comments Pagination and Post Navigation Link blocks. The Image and Playlist blocks benefit from hardening around preg_replace() replacements considered unsafe.
• Customizer : a stored XSS in the refresh process, and above all an information leak exposing unpublished Customizer changes to unauthenticated visitors.
• Administration : a stored XSS (Editor role required) in the personal data erasure requests screen, and hardening around unescaped usernames in the Network Users screens in multisite. Notably, both flaws are credited to Anthropic, the publisher behind the Claude AI.
• Notes : custom roles able to moderate comments could read, modify, and delete post notes they are not allowed to edit.
• Root certificates : WordPress’s built-in certificate store has been updated following the revocation of eMudhra.

Now it’s your turn: time to install the update!

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio