On 28 October 2026, WordPress released version 7.1.4, a security update that fixes 22 vulnerabilities. The most serious one sits in WordPress’s own update process, and security researchers report that attackers have been probing for it since shortly after the release. If you run a WordPress or WooCommerce site, check your version today.
Last updated: 31 October 2026. The details are still developing, so I will update this post if anything important changes.
Key takeaways
- WordPress 7.1.4 fixes 22 security flaws, and WordPress recommends installing it immediately.
- The most serious flaw is in the core updater. While an update is running, an outsider could reach the unpacked new version over the web and take over the site.
- Wordfence reports that attackers have tried to exploit it since shortly after the release.
- Older branches are covered too. Releases 7.0.8 and 6.9.11 contain the fixes, and WordPress 4.6 and earlier get no security updates.
- After updating, check your version and make sure no leftover update folders are sitting on the server.
What happened
WordPress published 7.1.4 on 28 October. Patchstack counts 22 vulnerabilities across 17 advisories, which is why you may see different numbers in different reports. The fixes cover core features, block editor blocks, admin screens, the Customizer and the Interactivity API.
As of 30 October, the updater flaw had no CVE number yet and was not in the CISA list of known exploited vulnerabilities. That can change quickly, so do not wait for it.
The most serious flaw: the updater
When WordPress updates itself, it unpacks the new version into a temporary folder inside your site. The flaw was a race condition. While the update ran, that unpacked copy could be reached over the web, and an outsider could use it to run code on the server without logging in. The WordPress announcement credits security researcher Umut Bayram for the report.
The fix in 7.1.4 makes the temporary folder names much harder to guess by adding 16 random characters. It also restores the index.php protection and stops wp-config.php from being copied from the working directory.
Because the request goes straight to the temporary copy, your security plugin inside WordPress may never see it. Protection has to come from the update itself or from the server.
Is it being attacked?
Wordfence says it has seen exploitation attempts since shortly after the release, as reported by Brandefense. WordPress itself does not say whether the flaw has been exploited in the wild. Treat it as urgent either way.
What else was fixed
- Stored cross-site scripting bugs that users with Contributor access or higher could use
- A leak of unpublished design changes in the Customizer
- A permission gap that let users read editorial notes on posts they cannot edit
- Safer handling of replacement values in the Image and Playlist blocks
- Fixes in the Interactivity API, including post content that could overwrite script module data
- A stored XSS issue linked to personal data erasure requests, and a username escaping problem on multisite Network Users screens
Which versions are fixed
- WordPress 7.1: update to 7.1.4
- WordPress 7.0: update to 7.0.8, which fixes all 22
- WordPress 6.9: update to 6.9.11, which fixes all 22
- Older branches back to 4.7: security fixes are being backported, and these branches are affected by fewer of the flaws. Check which release matches your branch.
- WordPress 4.6 and earlier: no security updates, so upgrade as soon as you can
How to update safely
- Take a backup of your files and your database.
- Check your version in Dashboard, then Updates, or in Tools, Site Health, Info.
- If automatic updates for minor releases are on (the default), your site may already be on 7.1.4. Many hosts also update for you. Still confirm it.
- If not, click Update now on the Updates screen, or ask your host to do it.
- Test your home page, login, forms and checkout.
- Update your plugins and themes the same day.
After updating: clear leftover folders
If an earlier update failed or stopped halfway, a copy of WordPress may still sit in wp-content/upgrade. That folder should be empty apart from an index.php file. If you see leftover folders, delete them after taking a backup, or ask your host to do it.
Also ask your host to block web requests to PHP files in that folder. It is a simple server rule, and it closes the door the updater attack uses. Then run the quick checks from my WordPress plugin attacks checklist: unknown administrators, PHP files in the uploads folder and unfamiliar plugins.
If you cannot update today
Ask your host about a server-level firewall rule that blocks web requests to PHP files inside wp-content/upgrade/. Imunify360, for example, describes such a rule. This only reduces the risk and is not a substitute for updating, so treat it as a short-term step.
Do not forget the layer below
WordPress runs on PHP, and PHP had its own critical security update last week. If you have not checked that yet, read this PHP security update guide.
How I can help
My Website Security service covers a security audit, malware scan and cleanup, and clear next steps. If you would like me to look at your site, send me a message with a few details and I will tell you what I would check first.
Frequently asked questions
I have automatic updates turned on. Do I need to do anything?
Yes, a quick check. Confirm your site shows 7.1.4 (or the fixed release for your branch) and look at the wp-content/upgrade folder for leftovers.
Will 7.1.4 break my site?
It is a security release, so the changes are focused on fixes. It is usually safe, but always take a backup and test your key pages afterwards.
I am on an older WordPress version. Can I stay there?
Move to the latest security release for your branch at least, such as 7.0.8 or 6.9.11, and plan an upgrade to the current version. Versions 4.6 and earlier get no security updates at all.
Does this affect WooCommerce stores?
Yes. WooCommerce runs on top of WordPress, so a flaw in core affects your store too. Update WordPress, then test your cart and checkout.