WordPress has released version 7.1.4 to address 22 security vulnerabilities across 17 advisories, urging website owners to install the update as soon as possible.
Released on October 28, the security update fixes several issues, including a race condition in the WordPress core upgrade process that could allow attackers to execute code remotely under specific conditions.
According to WordPress, the release addresses multiple security weaknesses, including stored cross-site scripting (XSS) vulnerabilities, information disclosure issues, and permission problems affecting different parts of the platform. Several flaws involve the Interactivity API, which powers interactive features in modern WordPress blocks. Depending on the vulnerability, exploitation may require an authenticated account with specific permissions.
One of the most concerning issues involves a race condition during core updates that could lead to remote code execution. Security researchers reported that the flaw could potentially be exploited without authentication during the short window in which an update is running. The risk depends on specific conditions, including access to the upgrade directory, making it important for administrators to apply the patch and ensure sensitive upgrade files are not publicly accessible.
The WordPress update also comes amid active exploitation of two separate critical PHP vulnerabilities known as PHP2Shell. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws can allow unauthenticated attackers to execute code remotely on vulnerable PHP installations. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both vulnerabilities to its Known Exploited Vulnerabilities catalog following reports of attacks in the wild. These PHP flaws are separate from the vulnerabilities fixed in WordPress 7.1.4, so updating WordPress alone will not protect systems running vulnerable PHP versions.
Administrators should update PHP to a fixed release, including PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on their current version and supported upgrade path. Older, unsupported PHP versions should be migrated to a maintained release. Website owners using Docker images or other environments that bundle PHP should also ensure the underlying images and packages contain the security fixes.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
WordPress recommends installing version 7.1.4 immediately through the dashboard or by downloading it from the official website. Security fixes have also been backported to supported older release branches. Administrators should verify that their hosting environment is patched, review access to privileged WordPress accounts, and monitor server logs for suspicious activity.
