WordPress 7.1.4 fixes 17 security flaws, including an RCE bug

WordPress released version 7.1.4 on 28 October 2026, fixing 17 security issues and updating bundled root certificates following the eMudhra revocation. The fixes include a race condition during core updates that could lead to remote code execution, reported by Umut Bayram. WordPress has not provided further technical details about that flaw. The update also fixes ten stored cross-site scripting (XSS) vulnerabilities; most require at least Contributor-level access.

Six affect the Interactivity API, including issues involving `javascript:` URLs, event-handler bindings and prototype pollution in context namespaces. Other XSS bugs affect Customizer selective refresh, block delimiters and the personal data erasure screen.

The release also prevents unpublished Customizer changes from being disclosed to unauthenticated visitors. Anthropic reported two of the issues, including the data-erasure XSS. The source says all WordPress versions before 7.1.4 lack the fixes, and that security patches are being backported to branches as far back as 4.7, with those updates to ship as they become ready.

WordPress recommends updating sites immediately; administrators can install 7.1.4 from the dashboard or check that automatic updates have applied it. The source reports no known exploitation in the wild and says no CVE IDs have been published.