WordPress 7.1.4 Closes an Update-Process RCE Risk and a Dozen Stored XSS Flaws

Released on October 28, 2026, WordPress 7.1.4 closes a weakness in the core update mechanism that could, under specific conditions, lead to remote code execution during the update window itself. The release also patches a dozen stored cross-site scripting (XSS) flaws spread across the block editor, the Interactivity API and the Customizer. The security team recommends updating affected sites immediately.

#A critical flaw in the update mechanism

The most sensitive fix touches the process that downloads and installs core, theme and plugin updates. Reported by researcher Umut Bayram, the weakness could, under precise server-side conditions, allow arbitrary code execution while WordPress updates itself. This class of vulnerability is particularly sensitive: it targets the very mechanism meant to protect sites against known flaws.

The fix tightens validation of downloaded packages before they are extracted and applied, with no visible change for administrators.

#A series of stored XSS issues in the block editor

Most of the remaining fixes address stored cross-site scripting flaws, where malicious code injected once stays active for every visitor who views the affected page. They cover:

• specially crafted block rendering (Rafie Muhammad);
• Privacy Data Removal Requests, a vector flagged by Anthropic;
• several points in the Interactivity API, including a stored denial-of-service case found by Jon Surrell;
• Customizer selective refresh (Rafie Muhammad);
• the Categories block (Ben Bidner);
• specially crafted login usernames, another vector flagged by Anthropic;
• the Playlist and Image blocks (Ben Bidner);
• the comments-pagination blocks (Alex Concha).

Two further fixes close the ability for unauthenticated visitors to discover unpublished Customizer changesets (Antonio Lorensius Silaban), and an authorization gap that made certain notes readable by privileged users without edit access to the attached post (Ramon).

#Updating from the command line

On a self-managed host, updating through WP-CLI remains the most reliable way to confirm the installed version before and after the operation:

wp core check-update
wp core update
wp core version --extra

On managed hosting without SSH access, the one-click update banner in the admin triggers the same patched process.

A flaw in the update process targets the defense mechanism itself, not just the surface it protects.

#Root certificates and the 7.2 timeline

7.1.4 also bundles an update to the root certificate store, in response to the eMudhra certificate revocation. Security fixes are being backported to all eligible branches, down to 4.7, shipping as they become ready. The next major release, WordPress 7.2, stays on track for December 8, 2026; its beta 3 already includes the fixes from this release.

#Key takeaways

WordPress 7.1.4 fixes eleven stored XSS flaws and a rarer weakness in the update process itself. No CVE has been published on the official page at this stage, but the recommendation to update immediately leaves no room for delay. It echoes the critical RCE flaw patched on an emergency basis in PHP the previous month: fixes touching the core of a platform deserve priority treatment.

Further reading: the full list of fixes is available in the official WordPress 7.1.4 announcement.