As cited
Copy frozen at (site build).
vulnerabilities
WordPress 7.1.4 Security Release
WordPress 7.1.4 was released on October 28, 2026, patching 22 vulnerabilities across 17 advisories. The most significant issue is an unauthenticated remote code execution (RCE) race condition in the upgrade process that exploits a predictable, web-accessible directory during updates. The remaining issues primarily require Contributor-level or higher access and include multiple cross-site scripting (XSS) flaws in the new Interactivity application programming interface (API), Customizer components, and block editors.
Why it matters: WordPress site operators must update immediately to block unauthenticated RCE via the upgrade directory (wp-content/upgrade/), and then audit who holds Contributor access and above since 20 of the 22 vulnerabilities require that privilege level or higher.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
WordPress 7.1.4 Security Release
WordPress 7.1.4 was released on October 28, 2026, patching 22 vulnerabilities across 17 advisories. The most significant issue is an unauthenticated remote code execution (RCE) race condition in the upgrade process that exploits a predictable, web-accessible directory during updates. The remaining issues primarily require Contributor-level or higher access and include multiple cross-site scripting (XSS) flaws in the new Interactivity application programming interface (API), Customizer components, and block editors.
Why it matters: WordPress site operators must update immediately to block unauthenticated RCE via the upgrade directory (wp-content/upgrade/), and then audit who holds Contributor access and above since 20 of the 22 vulnerabilities require that privilege level or higher.
- Source published
- First seen by Cybersecurity Tracker