WordPress 7.1.4 Fixes 22 Security Flaws, Including an Unauthenticated RCE Vulnerability

WordPress released version 7.1.4 on October 28, 2026, fixing 22 security flaws, including an unauthenticated remote code execution vulnerability in its update process. The security release also addresses stored cross-site scripting, data exposure, and access control issues. WordPress urges website owners to install the update immediately.

The official release announcement credits security researcher Umut Bayram with reporting the update flaw. Patchstack’s technical analysis describes 22 vulnerabilities across 17 advisories, explaining why the number of listed advisory entries differs from the total flaw count.

The release was led by Aaron Jorbin and Nik Tsekouras, with reports from independent researchers and the WordPress Security Team helping close weaknesses across older and newer features.

The most serious issue involves a race condition, where an attacker must reach a temporary installation at precisely the right time. Exploitation requires no WordPress account, but the attack depends on a short update window and public access to the wp-content/upgrade/ directory.

During updates, WordPress extracts files into that directory. Previously, predictable folder names and cleanup that removed index.php could expose an unpacked WordPress installer. An attacker reaching it during the update could run setup using a database they control, creating a path to code execution.

WordPress 7.1.4 adds 16 random characters to temporary folder names, restores index.php protection, and prevents wp-config.php from being copied from the working directory. Patchstack rates exploitation as difficult because the opportunity lasts only seconds. This is separate from the earlier WordPress Core template resolution vulnerability covered by Cybersecuritynews.com.

Stored XSS and Permission Gaps

Several fixes target the Interactivity API, which supports interactive page features. Attackers with Contributor access could save crafted attributes that passed content filtering but later triggered unsafe browser actions. The update blocks dangerous bindings, strengthens checks, and addresses a denial-of-service issue that could freeze a visitor’s browser tab.

Other stored XSS fixes cover crafted block markup, Customizer selective refresh, Categories, and navigation labels. Image and Playlist processing also received hardening. Stored XSS means harmful script content remains saved on a site and runs when another user opens the affected content.

Anthropic reported issues involving personal data removal requests and specially crafted usernames. A separate Customizer flaw exposed unpublished changes to visitors without accounts. WordPress also tightened note permissions so users cannot access notes attached to posts they lack permission to edit. These changes follow earlier WordPress security updates addressing similar risks.

Update WordPress and Check Protection

Administrators can install the release through Dashboard, Updates, and Update Now, or download WordPress 7.1.4 directly. Sites with automatic background updates should receive it automatically, but owners should confirm the installed version rather than assume the process completed.

The official version documentation lists patched older branches, including 7.0.8, 6.9.11, and releases extending to 4.7.39. Not every branch contains all 22 flaws. Only the latest WordPress version remains actively supported, while versions 4.6 and earlier receive no security updates.

Beyond patching, Patchstack recommends blocking web access to wp-content/upgrade/ at the web server and reviewing accounts with Contributor privileges or higher.

A WordPress plugin firewall may not protect the extracted installer because that copy loads independently. The release also updates bundled root certificates following the eMudhra revocation. WordPress 7.2 remains scheduled for December 8, but site owners should not delay this security update while waiting for that major release.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post WordPress 7.1.4 Fixes 22 Security Flaws, Including an Unauthenticated RCE Vulnerability appeared first on Cyber Security News.