WordPress 7.1.4: The Upgrade Flaw Every Site Owner Should Fix Now

WordPress powers a large share of the world's small business websites, so a WordPress security release is never just a developer's concern. On 28 October 2026, WordPress released version 7.1.4, a security release that fixes several issues. The most serious is a weakness in the upgrade process itself, which WordPress says can lead to remote code execution. This guide explains what that means, whether you are affected and how to update without breaking anything.

What WordPress 7.1.4 fixes

The release post describes 7.1.4 as a security release that "features fixes for multiple issues". The one site owners should understand is:

A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window.

Put simply, while WordPress is installing an update there is a short window in which, on an unpatched site, an attacker may be able to run their own code. Remote code execution is the most serious category of web vulnerability, because it can hand an attacker control of the site and sometimes the server beneath it.

Weekly security round-ups report that a WordPress core upgrade-path flaw affecting versions 4.7 to 7.1.3 was added to the US government's Known Exploited Vulnerabilities catalogue on 3 November. WordPress's own post does not name a CVE identifier, so we describe the flaw in WordPress's words and treat the catalogue listing as reported rather than confirmed by WordPress.

Who is affected

Which WordPress sites should update

Your situation	What to do
On WordPress 7.1.0 to 7.1.3	Update to 7.1.4 or newer now.
On an older branch (for example 7.0 or 6.9)	Install the newest security release for your branch as soon as it ships, then plan the move to 7.1.
Automatic updates switched off	You are the most exposed. Update manually today, then decide whether to turn automatic minor updates back on.
Managed WordPress hosting	Your host may have updated you already. Confirm the version rather than assuming.

How to check your WordPress version

1. In WordPress: log in and open Dashboard → Updates. The current version is shown at the top.
2. From the outside: our website security check reads your site's generator tag, feed and core files and reports the version if it is visible.
3. Ask your developer or host. If someone else looks after the site, ask them to confirm the version and the date it was last updated.

How to update safely

Minor security releases rarely break anything, but a little care avoids the rare bad day.

1. 01Back up firstTake a full backup of files and database, and make sure you know how to restore it.
2. 02Update coreInstall 7.1.4 from Dashboard, then Updates, or let your host apply it.
3. 03Update plugins and themeOld plugins are the most common way into WordPress sites. Update or remove any you no longer use.
4. 04Test the essentialsLoad the home page, submit the contact form and test any checkout or booking flow.

Do not forget PHP

WordPress 7.1.4 fixes WordPress. It does nothing for the PHP software underneath it. In the same month, the PHP project fixed two critical, actively exploited flaws known as PHP2Shell, and WordPress itself published a "Critical PHP Security Release" notice pointing site owners to them. If your server runs an affected PHP version, an up-to-date WordPress site is still exposed. Our guide to PHP2Shell explains which PHP versions are safe and how to update.

Make this the last emergency update

Every few months there is another urgent WordPress or plugin fix. Sites that are updated on a monthly routine treat them as a five-minute job. Sites that are left alone for a year find the urgent update is blocked by a dozen others. Our guide to website maintenance costs shows what a sensible routine costs, and our maintenance checklist shows what it should include.

If you would rather not think about it at all, our managed web application services keep WordPress, plugins, PHP and certificates current, with tested backups. Or contact us with your website address and we will tell you where you stand.