Updated on 29 Oct 2026

WordPress 7.1.4 arrived on 28th October 2026, bringing a security release that patches 22 vulnerabilities – including a flaw in the update process itself that could let an attacker run code on your server.

There are no shiny new features this time, just a big batch of fixes that make your site harder to break into. Here's what's changed, what it means for your site and how to update without any issues.

What's fixed in WordPress 7.1.4

This is a short-cycle release – a quick patch that goes out between major versions. The fixes cover several parts of WordPress core, and the major ones are as follows:

  • An update-process flaw. While WordPress updates itself, there's a brief moment when the update is only half done. If an attacker timed it just right, they could use that moment to run their own code on your server.
  • Lots of cross-site scripting (XSS) holes. These could let someone slip malicious scripts into places like blocks, the Customizer and the Interactivity API.
  • Permission gaps. Unpublished Customizer changes could be seen by visitors who weren't logged in, and some custom roles could reach notes on posts they had no business editing.
  • A denial-of-service bug. A stored issue in the Interactivity API could be used to knock parts of a site over.
  • Fresh root certificates. WordPress can keep making secure connections to other services after one certificate authority's certificates were revoked.

Want the full technical rundown? The official WordPress 7.1.4 release post and HelpHub page have every detail.

What it means for your site

Most of these vulnerabilities need someone to be logged in with at least Contributor access before they can be exploited. If you're the only person who logs into your site, that lowers the risk. But if you've got writers, guest bloggers or freelancers with their own accounts, it's a different story – any one of those logins could become a way in.

The update-process flaw is the one to take seriously. At the time of writing, it’s not yet clear exactly what an attacker would need to pull it off, and that's reason enough to patch now rather than wait and find out. Some of these issues also date back as far as WordPress 4.7 – so running an older version doesn't make you safer.

If your site's hosted with Fasthosts, there's some good news. We've already got these vulnerabilities covered – our web application firewall is protecting every site we host.

It's been a busy few months for WordPress security, too. This is the fourth security release since WordPress 7.1 launched in August, which is a good reminder that updates aren't a once-in-a-while job.

How to update safely

ⓘ

If you’re on Fasthosts Hosting for WordPress with automatic updates enabled, we've already taken care of the update for you – there's nothing you need to do.

With a major WordPress release, it can pay to hold off for a few days while early bugs get ironed out. Security releases are different – WordPress recommends updating straight away, and nothing in 7.1.4 should change how your site looks or works. A few minutes of prep is never wasted, though:

  1. Back up your site. Files and database, so you've always got something to roll back to.
  2. Test it first if you need to. If your site's business-critical or heavily customised, try the update on a staging site before going live.
  3. Update your plugins and theme too. They're a far more common way in than WordPress core.
  4. Run the update. Go to Dashboard > Updates in your WordPress admin, click update and check your version number reads 7.1.4 afterwards.

Got automatic background updates switched on? You might already be running 7.1.4 – it's still worth logging in to make sure.

What's next – WordPress 7.2

The next major release, WordPress 7.2, is currently planned for 8th December 2026. We'll take a look at what's new when it lands. Until then, staying on top of security releases like this one is the simplest way to keep your site safe.

Less time on updates, more time on your site

Keeping WordPress patched is one of those jobs that's easy to put off – until it really isn't. Hosting for WordPress from Fasthosts gives you a fast, secure home for your site, with automatic updates to keep WordPress current, servers in our UK data centres and 24/7 support if you ever get stuck.