WordPress 7.1.4 Security Release: What UK Small Business Owners Need to Check

WordPress released version 7.1.4 on 28 October 2026 as a security release fixing 22 vulnerabilities in WordPress Core. If your business website runs on WordPress, this is one update worth checking rather than assuming it has taken care of itself.

The release covers WordPress versions from 4.7 through 7.1.3, with patched versions issued for each affected branch, including 7.0.8 and versions going back to 4.7.39. WordPress recommends installing the update immediately, and most sites that support automatic background updates should receive it without any action. The catch, as security firm Wordfence points out, is that “should” is not the same as “has”: site owners should confirm the update actually completed.

The most serious flaw fixed in 7.1.4 is an unauthenticated race condition in the Core update process that can lead to remote code execution, rated 8.1 (High) on the CVSS scale. In plain terms, during a full-package Core update, WordPress unpacks the new files into a temporary staging directory beneath wp-content/upgrade. On many servers that directory is web-accessible, and an attacker who requests the staged installer at precisely the right moment could progress to running code on the server. No account on the site is needed.

That window is narrow — in lab environments the staging directory normally remained available for only seconds — but attackers are already trying to catch it. According to Wordfence telemetry, the first match for its new firewall rule arrived nine minutes after the rule was deployed on 28 October, and more than 18,500 requests targeting staged setup-config.php installer paths were recorded during the first 21 hours. Two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours, behaviour consistent with trying to catch the brief upgrade window. WordPress 7.1.4 addresses the issue by randomising the staging directory, adding an index guard, and preventing unsafe promotion of staged configuration data.

The remaining fixes in the release include multiple stored cross-site scripting vulnerabilities, several Interactivity API issues, an unauthenticated information disclosure issue that could expose unpublished Customizer changesets, an authorisation weakness in the Notes REST API, and an update to bundled root certificates following the eMudhra revocation. Many of these require an authenticated Contributor, Author, or Editor account, which lowers their exposure compared with the unauthenticated flaw, but stored cross-site scripting can still lead to account takeover or unwanted site changes when a privileged user views malicious content. Sites running WordPress 4.6 or earlier no longer receive security updates at all and should be upgraded to a supported release.

What this means for your business

For a small business, a website problem rarely announces itself. A compromised site can quietly redirect visitors, display content you never approved, or damage the trust that brings customers to your door in the first place. The practical steps here are short and worth doing this week.

First, check your version. In your WordPress dashboard, go to Dashboard > Updates and confirm your site is running WordPress 7.1.4 or the corresponding patched release for its branch. Do not assume an automatic update completed — verify it.

Second, if your site was unpatched while these flaws were public, look for signs of trouble: unexpected administrator accounts, plugins you did not install, unfamiliar PHP files, or unusual requests to files beneath wp-content/upgrade. A security scan after updating can help identify unexpected Core changes or malicious files.

Third, treat updates as routine maintenance, not a one-off chore. Security releases like this one arrive without warning, and the gap between a fix being published and attackers probing for unpatched sites is now measured in minutes, not weeks.

A note from Zain Ali, founder of Zee Developers

“Most small business owners I speak to never think about WordPress updates until something goes wrong, and by then the fix is much harder than the update would have been. This release is a good reminder of why keeping a site up to date matters: the most serious flaw here needed no login at all, and attackers started probing for it within minutes of the fix going public. Checking your version takes a couple of minutes, and it is the simplest step you can take to keep your website — and your customers’ trust — safe.”

If you are unsure whether your website is up to date, or you would like help checking it over, get in touch with Zee Developers and we will be happy to help.