WordPress 7.1.4 security update: what to do

WordPress released version 7.1.4 on 28 October 2026 (29 October, Malaysia time). It is a security release and the WordPress team asks every site owner to update straight away. If your site has automatic updates turned on, it may already be done. If not, take a backup and update today.

Attacks have started (4 November 2026)

The US cybersecurity agency CISA added the update process flaw, now numbered CVE-2026-119977, to its list of holes that attackers are using, on 3 November 2026. CISA says a visitor with no login can run code on the server while a full WordPress core update is in progress, because the update unpacks its files into a folder whose name is easy to guess and which can be opened from the web. Sites on 4.7 to 7.1.3 are at risk. If your site is not on 7.1.4 yet, or on the fixed small update of its own version line, update it today.

What does WordPress 7.1.4 fix?

The release closes more than ten security problems. The main ones:

• A weakness in the WordPress update process. During the short time an update runs, it could let an attacker run their own code on the site.
• Many "stored cross-site scripting" holes. These let someone save a hidden script inside the site, for example in certain blocks, in a user login name or in a privacy data removal request. The script then runs when an admin or a visitor opens the page, and can be used to steal a logged-in session.
• One problem where a visitor with no login could find draft Customizer changes that were not published yet.
• One problem where an editor could read notes on a post they are not allowed to edit.
• One problem that could slow a site down through the Interactivity API.

WordPress also updated its built-in list of trusted security certificates, after the eMudhra certificate authority was removed from trust.

Who is affected?

Every WordPress site below 7.1.4. Older sites still on 4.7 to 7.0 will get the same fixes as small updates within their own version line, but WordPress only fully supports the newest version. If your site is many versions behind, plan a move to 7.1.4.

What to do

1. Take a backup of your files and database first, with your own backup plugin or by asking your web team.
2. Log in to your WordPress admin and open Dashboard > Updates. If it shows 7.1.4, you are done with this step. If not, click Update Now.
3. Open your home page, contact form, shop pages and checkout. Make sure they still work.
4. Check that automatic updates are on for minor and security releases. On the same Updates page WordPress tells you if the site updates itself.
5. Update your plugins and theme as well, one at a time. The WordPress update does not touch them.

If a web designer or agency looks after your site, send them this page and ask them to confirm the version today.

How SyncTech can help

If you would rather not do this yourself, our WordPress maintenance service covers backups, updates and a check of the site after each one.

Updated 4 November 2026: CISA confirms attackers are using the update process flaw (CVE-2026-119977); added the "Attacks have started" section.

Source and credit

We are sharing this news from WordPress.org and CISA. This summary is written by Synctech in our own words.

• WordPress 7.1.4, WordPress.org News, 28 October 2026: https://wordpress.org/news/2026/10/wordpress-7-1-4/
• Known Exploited Vulnerabilities Catalog, CVE-2026-119977, CISA, 3 November 2026: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Retrieved 29 October 2026 and 4 November 2026. WordPress is a trademark of the WordPress Foundation. eMudhra is a trademark of its owner. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.