Tech News · Wordfence
WordPress 7.1.4 security update — what site owners should do
“Because this is a security release, it is recommended that you update your sites immediately.”
— WordPress.org, WordPress 7.1.4 release announcement
What happened
The WordPress 7.1.4 security update was released on October 28, 2026, and it fixes 22 vulnerabilities in WordPress core, the free software that powers a large share of small business websites. The most serious fix closes a weakness in the WordPress upgrade process that could allow remote code execution during the short window while a site is being updated.
One day later, on October 29, the security firm Wordfence warned that attackers were already trying to take advantage of that flaw. According to its advisory, as reported by SecurityOnline and GBHackers, Wordfence recorded more than 18,500 malicious requests aimed at the vulnerable upgrade path within 21 hours, and saw the first matching attempt nine minutes after it deployed a firewall rule. Wordfence says the flaw affects WordPress versions 4.7 through 7.1.3, and it carries a severity score of 8.1 out of 10. Reports stress that these are exploitation attempts, not confirmed break-ins.
The other fixes in this WordPress security release cover a long list of stored cross-site scripting (XSS) bugs in blocks, the Customizer and the Interactivity API, a denial-of-service issue, and a bug that let anonymous visitors see unpublished Customizer changes. Many of these require a logged-in user with at least Contributor access. WordPress also backported the fixes to older branches, including 7.0.8, 6.9.11 and 6.8.12, all the way down to 4.7.39. Versions 4.6 and earlier get no security updates at all.
The WordPress 7.1.4 upgrade-window bug is unusual because the risky moment is the update itself. Researchers say vulnerable sites briefly unpack update files into a predictable folder, and an attacker who requests the right file at the right second can run code on the server. The window is only seconds long, so attackers are repeatedly polling sites, waiting for one to start updating. Once a site is on 7.1.4 or a patched older branch, that window is closed for future updates.
FuzeForth’s take
This is the kind of patch business owners should not leave for “next month.” Your website is often the first thing a customer sees, and it may hold contact forms, bookings, or order details. A server-level compromise can mean defaced pages, spam redirects, stolen customer data, or Google flagging your site as unsafe, which hurts both trust and search traffic.
The good news is that the fix is simple. Many sites update themselves automatically, but do not assume it happened. Log in, go to Dashboard > Updates, and confirm you are on 7.1.4 or the security release for your branch. If you manage several sites, or a developer built your site years ago and nobody has logged in since, check each one. Sites stuck on very old versions are the biggest worry, and anything on 4.6 or earlier is overdue for a rebuild, not just a patch.
Take a minute after updating to look for warning signs: administrator accounts you don’t recognize, plugins you didn’t install, or odd files in the wp-content/upgrade folder. If you don’t have the time or in-house skills to do this every time a security release lands, that is exactly what ongoing WordPress maintenance and security monitoring is for. And if your site is too old to update safely, a website rebuild on a current, supported WordPress setup is usually cheaper than cleaning up after a hack.
Key points
- WordPress 7.1.4, released October 28, 2026, fixes 22 security vulnerabilities in WordPress core.
- The most serious flaw could allow remote code execution during a core update; Wordfence says it affects versions 4.7 through 7.1.3 and that attackers began probing for it within a day.
- Fixes were backported to older branches down to 4.7.39; WordPress 4.6 and earlier no longer receive security updates.
- Check Dashboard > Updates to confirm every site you own is on 7.1.4 or its branch’s security release, then review admin users and plugins.
Frequently asked questions
Does WordPress 7.1.4 install automatically?
On sites that support automatic background updates, WordPress says the update process will begin automatically. Security researchers still recommend logging in and confirming the version under Dashboard > Updates rather than assuming it finished.
Is the WordPress 7.1.4 vulnerability being exploited?
Wordfence reports active exploitation attempts against the upgrade-window flaw, with more than 18,500 malicious requests in the first 21 hours. Reports stress that these are attempts, not confirmed successful compromises.
I’m on an older WordPress version. Am I protected?
If your site runs a branch from 4.7 onward, WordPress released a matching security update, such as 7.0.8 or 6.9.11, so make sure that release is installed. Sites on 4.6 or earlier receive no security fixes and should be upgraded.
Sources
- WordPress.org — WordPress 7.1.4 Security Release
- WordPress.org — Version 7.1.4 documentation
- Search Engine Journal — WordPress Announces Another Security Release: Version 7.1.4
- SecurityOnline — WordPress Core Vulnerability Exploited in the Wild
- GBHackers — WordPress 7.1.4 Fixes 22 Security Vulnerabilities, Including RCE Flaw Under Active Attack
