WordPress.org released WordPress 7.1.4 on October 28, 2026. This is a security release, and WordPress.org recommends updating your sites immediately. The patched versions are 7.1.4, or 7.0.8 if your site runs the 7.0 branch.
The highest-impact fix closes a race condition in core updates that could lead to remote code execution. The release applies to sites on Hosting for WordPress plans at InMotion Hosting, and to any WordPress install you manage yourself.
What the WordPress 7.1.4 Security Release Fixes
The announcement lists 12 fixes plus a certificate update. The release documentation breaks them out in more detail. Neither page publishes severity ratings or CVE (Common Vulnerabilities and Exposures) identifiers.
Most of the fixes are stored cross-site scripting (XSS) issues. In a stored XSS attack, someone saves a harmful script that later runs in another user’s browser. The documentation labels many of these fixes as needing an account at Contributor level or higher.
Race condition in core updates
A race condition during core updates could lead to remote code execution (RCE), which means an attacker could run code on the server. Umut Bayram reported it. WordPress.org does not rate its severity. Still, RCE is the highest-impact class among these fixes, which is why prompt updating matters.
Stored XSS and denial of service
The largest group of fixes covers stored XSS in several places:
- Interactivity API bindings, event handlers, context namespaces, and the Interactivity Router. The Interactivity API is the standard way developers add interactive features to blocks.
- Customizer selective refresh, which updates only the changed parts of the Customizer preview.
- The Categories block and the labels of the Comments Pagination and Post Navigation Link blocks.
- Crafted block markup, and the personal data erasure requests screen.
The release also fixes a denial-of-service issue in Interactivity API bindings that could make a page unavailable. Hardening fixes cover the Image and Playlist blocks and usernames on the multisite Network Users screens.
Information disclosure and permissions
An information disclosure issue exposed unpublished Customizer changes to visitors who were not logged in. A separate permissions fix stops custom roles that moderate comments from reading, editing, and deleting notes on posts they cannot edit.
Updated root certificates
WordPress 7.1.4 also updates the bundled root certificates because of the eMudhra revocation. Core uses these certificates to verify secure connections it makes to other servers.
Which WordPress Versions Are Affected
WordPress 7.0 and 6.9 are affected by all 22 vulnerabilities, and older branches by fewer. WordPress.org also made the fixes available for older branches as a courtesy. Its release documentation lists a patched version for each branch back to 4.7, including 7.0.8, 6.9.11, and 6.8.12. Versions before 4.7 no longer receive security updates.
Only the most recent version of WordPress is actively supported. If your site runs an older branch, plan a move to the current release rather than relying on backports. Check the official WordPress 7.1.4 documentation for the patched version of your branch, and check again later if your dashboard does not offer it yet.
What This Means for InMotion Hosting Customers
Hosting for WordPress plans at InMotion Hosting run WordPress core, so this release applies to them like any other WordPress site. The same is true for WordPress sites you install yourself on Shared, Reseller, VPS, or Dedicated plans. You manage the WordPress version on installs you set up yourself, so confirm yours is patched.
WordPress.org says that on sites that support automatic background updates, the update process will begin automatically. Do not assume yours has finished. Check the version.
How to Update to WordPress 7.1.4
Log in to wp-admin and open Dashboard > Updates. If the version shown is not 7.1.4 (or 7.0.8 if your site runs 7.0), click Update Now. This one-click update works on most servers, and WordPress.org covers it in Updating WordPress.
If you manage WordPress over SSH, WP-CLI (the WordPress command line tool) updates core with one command:
wp core updateThen confirm the result with this command:
wp core versionNote: Back up your site before you update if you have not done so recently. A current backup makes any problem easy to undo.
Keep core auto-updates turned on after you update. On most sites, security releases then arrive through the background update system without any action on your part. That narrows the window between a release and your site being protected. For setup details, see the guide to automatically updating your WordPress site, or browse the WordPress Tutorials for more on managing your install.
For the full list of fixes and files changed, see the official WordPress 7.1.4 announcement. If you need help updating a site on your InMotion Hosting account, open a ticket from your Account Management Panel (AMP) or start a live chat with our support team.
