WordPress released security version 7.1.4 on October 28 and recommends updating immediately. The most serious fix is a race condition in the core upgrade process that can lead to remote code execution, tracked as CVE-2026-119977. NVD's description: in WordPress 4.7 through 7.1.3, full-package core upgrades use predictable, web-accessible staging paths, so unauthenticated attackers can execute code on the server during the upgrade window; CVSS 3.1 8.1 (attack complexity rated high). On November 3 CISA added it to its Known Exploited Vulnerabilities (KEV) catalog, gave federal agencies just three days (until November 6) and marked it as requiring forensic triage.

What Else 7.1.4 Fixes

  • Multiple stored XSS issues: block markup, the Interactivity API, Customizer selective refresh, the Categories block, the Playlist and image blocks, the comments pagination blocks, plus specially crafted user logins and privacy data removal requests. Most require contributor or editor privileges or higher.
  • Unpublished Customizer changesets could be discovered by unauthenticated visitors, and custom roles that moderate comments could read and edit notes on posts they cannot edit.
  • Because of the eMudhra certificate incident, the root certificate bundle that WordPress ships (used for its own HTTPS requests) was updated.

How to Confirm You Are Safe

  • Check the version: Dashboard → Updates, or wp core version with WP-CLI. The latest is 7.1.4; for sites still on older branches, WordPress's version API lists backports including 7.0.8, 6.9.11 and 6.8.12, all the way down to 4.7.39. Older releases such as 7.1.3 and 7.0.7 are now marked insecure, and WordPress reminds users that only the latest version is actively supported.
  • WordPress says sites with automatic background updates will update on their own, but don't assume: if you disabled automatic updates in wp-config.php (for example with AUTOMATIC_UPDATER_DISABLED) or the site's file permissions block writes, you have to update by hand. If you run WordPress from Debian's package, Debian issued DSA-6596-1 on October 29.
  • Since CISA calls for forensic triage, take one more look after updating: any administrator accounts you don't recognise, and any unfamiliar .php files in the site root or wp-content (including wp-content/upgrade/, where upgrade files are staged).

Check the PHP Flaws From the Same Weeks Too

WordPress runs on PHP. Late October's php2shell flaws are now exploited in the wild and can be chained with a kernel bug for root, as described in this report; the previous exploited WordPress core flaw was September's CVE-2026-87902, covered here. For the full self-hosting walkthrough see building a WordPress site on a VPS, and before upgrading, keep a copy using one of these backup strategies.