WordPress.org released WordPress 7.1.4 on 28 October 2026 as a security release and recommends that sites update immediately; sites with automatic background updates will update automatically.

The release post credits reporters for: a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window (Umut Bayram); several stored cross-site scripting (XSS) bugs, including in specially crafted block markup, the Interactivity API, Customizer selective refresh, the Categories, Playlist, image and comments-pagination blocks, Privacy Data Removal Requests and specially crafted user logins (the last two reported by Anthropic); a stored denial-of-service issue in the Interactivity API; unpublished Customizer changesets that unauthenticated users can discover; and Notes that privileged users can read without access to edit the attached post.

The release also updates the bundled root certificates because of the eMudhra revocation. WordPress says the security fixes are being backported to all branches eligible for security fixes (currently back to 4.7) and will ship as they become ready, and that WordPress 7.2 Beta 3 contains all applicable fixes.

The post does not give CVE numbers or severity scores and does not say any of the flaws is being exploited. (source: WordPress.org)