# WordPress 7.1.4 security release: upgrade-window RCE and a batch of stored XSS fixes · pwn.watch > WordPress released 7.1.4 on Oct 28 2026 as a security release and recommends updating sites immediately. It fixes a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window (reported by Umut Bayram), a long list of stored XSS issues (crafted block markup, Privacy Data Removal Requests, the Interactivity API, Customizer selective refresh, the Categories, Playlist, image and comments-pagination blocks, and specially crafted user logins), a stored denial of service in the Interactivity API, unpublished Customizer changesets being discoverable by unauthenticated users, and Notes being readable by privileged users who can't edit the post. It also updates the bundled root certificates because of the eMudhra revocation. Sites with automatic background updates get it automatically; the fixes are being backported to every branch still eligible for security fixes (back to 4.7), and those backports ship as they become ready. WordPress 7.2 Beta 3 has the same fixes. Page: https://pwn.watch/i/wordpress-7-1-4-security-release-oct-2026 · generated 2026-10-28T22:05:28.248Z ## Status - Severity: high · status: live · patch: patched - Product: WordPress core - Started: 2026-10-28 - Affected: WordPress before 7.1.4 (fixes backported to branches back to 4.7, shipping as they become ready) - Fixed in: 7.1.4; 7.2 Beta 3 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/wordpress-7-1-4-security-release-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/wordpress-7-1-4-security-release-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/wordpress-7-1-4-security-release-oct-2026.json - This file: https://pwn.watch/i/wordpress-7-1-4-security-release-oct-2026/llms.txt ## Updates (newest first) - 2026-10-28: WordPress releases 7.1.4, a security release fixing an upgrade-process RCE, multiple stored XSS issues, an Interactivity API stored DoS, unauthenticated discovery of unpublished Customizer changesets and a Notes access issue, plus a root certificate update for the eMudhra revocation. Backports to older branches are in progress. (https://wordpress.org/news/2026/10/wordpress-7-1-4/) ## Fix brief # Security brief: WordPress 7.1.4 security release: upgrade-window RCE and a batch of stored XSS fixes Source: https://pwn.watch/i/wordpress-7-1-4-security-release-oct-2026 · status: live · severity: high · updated Oct 28, 2026, 20:25 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is WordPress released 7.1.4 on Oct 28 2026 as a security release and recommends updating sites immediately. It fixes a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window (reported by Umut Bayram), a long list of stored XSS issues (crafted block markup, Privacy Data Removal Requests, the Interactivity API, Customizer selective refresh, the Categories, Playlist, image and comments-pagination blocks, and specially crafted user logins), a stored denial of service in the Interactivity API, unpublished Customizer changesets being discoverable by unauthenticated users, and Notes being readable by privileged users who can't edit the post. It also updates the bundled root certificates because of the eMudhra revocation. Sites with automatic background updates get it automatically; the fixes are being backported to every branch still eligible for security fixes (back to 4.7), and those backports ship as they become ready. WordPress 7.2 Beta 3 has the same fixes. Severity detail: WordPress calls it a security release and says to update immediately; the most serious fix is remote code execution during the upgrade window, most others are stored XSS. No exploitation reported and no CVE ids published yet - Product: WordPress core ## Affected versions - WordPress before 7.1.4 (fixes backported to branches back to 4.7, shipping as they become ready) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 7.1.4 - 7.2 Beta 3 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes Update WordPress core to 7.1.4 from the Dashboard (Updates, then Update Now) or let automatic background updates apply it. If you are pinned to an older branch, watch for its backport release and apply it when it ships. Since one fix concerns the upgrade process itself, update promptly rather than leaving sites mid-upgrade. ## Latest updates - Oct 28, 2026: WordPress releases 7.1.4, a security release fixing an upgrade-process RCE, multiple stored XSS issues, an Interactivity API stored DoS, unauthenticated discovery of unpublished Customizer changesets and a Notes access issue, plus a root certificate update for the eMudhra revocation. Backports to older branches are in progress. ## Advisories - [WordPress 7.1.4](https://wordpress.org/news/2026/10/wordpress-7-1-4/) (WordPress) - [WordPress 7.1.4 (HelpHub release notes)](https://wordpress.org/documentation/wordpress-version/version-7-1-4/) (WordPress) ## Caveats Reporters credited by WordPress include Umut Bayram, Rafie Muhammad (Awesome Motive), Anthropic, AnC and DatNLQ (VietSunshine Cyber Security), rekter0, Anas cherni, Marcel Karlsson, Antonio Lorensius Silaban and members of the WordPress Security Team. --- Machine-readable: https://pwn.watch/i/wordpress-7-1-4-security-release-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.