WordPress 7.1.4 Security Update: What the 22 Fixes Mean for Your Site

By Expert Themes Editorial

Direct answer: WordPress 7.1.4, released October 28, 2026, is a security release fixing 22 flaws, including an unauthenticated remote code execution vulnerability in the update process itself. WordPress urges owners to install it immediately. Update in this order: back up first, then core, then themes and plugins, then test everything.

What is WordPress 7.1.4?

WordPress 7.1.4 is a security and maintenance release published on October 28, 2026. Unlike a major release, it does not add headline features. Its job is narrower and more urgent: close security holes. The release fixes 22 security flaws documented across 17 advisories — the count differs because some advisories cover more than one flaw — spanning the update process, stored cross-site scripting (XSS), data exposure, and access control issues.

The release was led by Aaron Jorbin and Nik Tsekouras, with reports from independent researchers and the WordPress Security Team. Security researcher Umut Bayram is credited with reporting the most serious flaw, in the update process. That credit trail matters: it tells you these flaws were found through responsible disclosure and fixed in a coordinated release, not discovered mid-attack.

One important clarification: 7.1.4 is separate from the PHP2Shell emergency earlier in October. PHP2Shell was a flaw in PHP, the language underneath WordPress, fixed by a server-level PHP update. The 7.1.4 flaws are in WordPress itself, fixed by updating WordPress. If you only did one of the two updates, you are only half covered — both matter, and they are fixed in different places.

What was the most serious flaw?

The most serious issue is an unauthenticated remote code execution vulnerability in the WordPress update process. Here is how it worked. During an update, WordPress extracts files into a temporary directory under wp-content/upgrade/. Previously, the temporary folder names were predictable, and cleanup steps could remove the index.php file that normally blocks directory browsing. That combination could expose an unpacked WordPress installer before the update finished.

An attacker who reached that exposed installer at precisely the right moment — during the short window while an update was running — could run the setup process against a database under their own control, creating a path to code execution on the site. No WordPress account was required. That is what “unauthenticated” means here: the attacker did not need to log in to anything.

Before you panic, note the practical limits. Patchstack, which analyzed the flaws, rates exploitation as difficult, because the opportunity lasts only seconds and depends on exact timing plus public access to the upgrade directory. This is not a flaw an attacker can trigger at leisure against any site. But “difficult” is not “impossible,” and automated scanning means someone will try. The fix in 7.1.4 is structural: temporary folder names now include 16 random characters, index.php protection is restored, and wp-config.php can no longer be copied from the working directory during updates. The window is effectively closed.

What else did 7.1.4 fix?

Beyond the update-process flaw, 7.1.4 addresses stored cross-site scripting, data exposure, and access control weaknesses across older and newer features. Stored XSS matters because it lets an attacker store malicious script that later runs in another user’s browser — for example, in an admin session — which can lead to account takeover. Data exposure flaws can leak information that should stay private, and access control flaws can let lower-privileged users reach functions reserved for higher roles.

The release notes do not turn each of these into a headline, and that is normal for a security release: the point is to patch quietly and completely, not to publish a how-to guide for attackers. What site owners need to know is the aggregate picture — 22 flaws across the platform, several of them in areas that touch everyday site operation — and the correct response, which is to update rather than to audit each flaw individually.

Note what 7.1.4 is not: a response to a mass compromise. There is no indication these flaws were exploited at scale before release. The risk comes from delay — once a release is public, the fixed flaws are effectively documented, and unpatched sites become the easiest targets.

Should I update immediately?

Yes — with one qualifier: back up first, which takes minutes and is covered below. WordPress urges owners to install 7.1.4 immediately, and that advice is sound. The most serious flaw touches the update mechanism itself, which makes prompt patching more valuable than usual: every future update you run on an unpatched site passes through the vulnerable process.

If your site is on managed hosting with automatic core updates, check that 7.1.4 has actually been applied — automatic does not always mean instant, and some hosts stage rollouts. Go to Dashboard, then Updates, and confirm the version. If your site updates manually, schedule the update for the next available window rather than letting it drift to “sometime this month.” Security releases have a short useful life: their value is highest in the first days after release.

One exception: if your site is mid-launch or in a critical sales period, a delay of hours while you prepare a backup is reasonable. Leaving a known unauthenticated RCE unpatched for weeks because updates feel risky is not.

How do I update safely?

Follow this order, and do not skip the backup. First, take a complete backup — files plus database — and confirm it exists before you touch anything. If your backup tool offers a restore test, use it: a backup you cannot restore is not a backup.

Second, update WordPress core to 7.1.4. Third, update your themes and plugins. If you run a theme from a marketplace, make sure you are updating from a legitimate source — replacing an outdated theme with a fresh copy from a trusted vendor is safer than patching files by hand. When you review your theme setup, browsing the WordPress themes catalog is a sensible place to confirm you are on a current, supported theme rather than an abandoned one.

Fourth, test. Visit the homepage, submit a form, and run through any checkout, signup, or member flow your site depends on. Check the site on a phone as well as a desktop, since mobile layout issues are the most common thing owners miss after updates. Fifth, confirm the version in Dashboard, then Updates, and note the date. If you manage several sites, work through them in the same order and keep a simple log — site, version, date, issues found — so the next security release takes minutes instead of an investigation.

What if something breaks after updating?

Most 7.1.4 updates will be uneventful, but if something does break, work methodically instead of reverting everything at once. First, identify what broke: a specific plugin, a theme feature, or a custom snippet. Deactivating plugins one at a time (or in halves, for a large set) finds the culprit faster than guessing. If a theme feature broke, switch briefly to a default theme to confirm whether the theme or something else is responsible.

Second, check for updates to the broken component itself — plugin and theme authors commonly ship compatibility fixes within days of a core security release. Third, if the breakage is serious and you cannot isolate it quickly, restore from the backup you took before updating, then retry the update on a staging copy while you resolve the conflict. Never edit core files to work around a conflict, and never delete plugins at random while diagnosing — both habits create bigger problems than the one you started with.

Finally, remember that staying on an old version to avoid a compatibility issue is a trade, not a solution. An unpatched site with a known unauthenticated RCE is exposed to everyone; a compatibility issue affects your site’s features. Fix the compatibility issue, keep the security update, and treat the combination — patched core, current themes, current plugins — as the normal state of your site, not an exceptional event.