WordPress 7.1.4 security release: upgrade-window RCE and a batch of stored XSS fixes

WordPress released 7.1.4 on Oct 28 2026 as a security release and recommends updating sites immediately. It fixes a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window (reported by Umut Bayram), a long list of stored XSS issues (crafted block markup, Privacy Data Removal Requests, the Interactivity API, Customizer selective refresh, the Categories, Playlist, image and comments-pagination blocks, and specially crafted user logins), a stored denial of service in the Interactivity API, unpublished Customizer changesets being discoverable by unauthenticated users, and Notes being readable by privileged users who can't edit the post. It also updates the bundled root certificates because of the eMudhra revocation. Sites with automatic background updates get it automatically; the fixes are being backported to every branch still eligible for security fixes (back to 4.7), and those backports ship as they become ready. WordPress 7.2 Beta 3 has the same fixes.

Why this severity: WordPress calls it a security release and says to update immediately; the most serious fix is remote code execution during the upgrade window, most others are stored XSS. No exploitation reported and no CVE ids published yet

Started

Oct 28, 2026

• PHP
• WordPress
• RCE
• #XSS
• #eMudhra

Notes & caveats

Reporters credited by WordPress include Umut Bayram, Rafie Muhammad (Awesome Motive), Anthropic, AnC and DatNLQ (VietSunshine Cyber Security), rekter0, Anas cherni, Marcel Karlsson, Antonio Lorensius Silaban and members of the WordPress Security Team.