WordPress 7.1.4 fixes 22 flaws, including update RCE
WordPress 7.1.4, released on 28 October 2026, fixes 22 vulnerabilities covered by 17 security advisories. That is a substantial increase from WordPress 7.1.3, which addressed seven vulnerabilities three weeks earlier. Most of the new flaws require an existing account, commonly one with the Contributor role, but two can expose information or functionality without authentication. The most serious is a race condition, meaning a security failure caused by precisely timed operations, that can lead to remote code execution (RCE), or running code on the affected server, while WordPress is being updated.
Several advisories concern stored cross-site scripting (stored XSS), in which harmful browser code is saved in site content and executes when another person opens the affected page. Contributor-level users could exploit weaknesses involving block delimiter whitespace, Customizer selective refresh, Categories block formatting, Comments Pagination and Post Navigation Link labels, and several parts of the Interactivity API. Other conditions varied: the Interactivity Router issue required an Author account with permission to upload files, while the personal data erasure screen required an Editor account and an administrator opening Tools, then Erase Personal Data. A multisite hardening fix addresses unescaped usernames containing markup when those names were stored by something outside WordPress core and viewed by a network administrator.
The update-process RCE requires no account, but Patchstack describes exploitation as impractical because the attacker must act during a window lasting only a few seconds. During installation or updating, WordPress extracts a software package into wp-content/upgrade/, a directory that may be served publicly by the web server. Before 7.1.4, its temporary folder inherited a predictable name from the package. The initial cleanup also removed everything in that directory, including the index.php file that normally prevents directory listings.
For those few seconds, an extracted WordPress installation could therefore exist at a predictable, potentially browsable address. It included wp-admin/setup-config.php, which could start without the original site configuration. If an attacker reached that file at the right moment, the attacker could run the installer using a database under their control while the files remained inside the victim site's document root. Patchstack rated the issue AC:H, meaning high attack complexity, but noted that it needs neither an account nor user interaction, has existed since WordPress 2.8 and reappears during every update, including unattended updates.
WordPress 7.1.4 adds 16 random characters to the temporary directory name, restores index.php and stops deleting that file. Patchstack also found a separate change in update-core.php that places wp-config.php on the list of files that must never be copied from the working directory. A firewall running through PHP cannot intercept the vulnerable request because the extracted package loads its own WordPress files, and the official archive contains no mu-plugins directory from which the site's firewall could run. Patchstack therefore advises blocking web access to wp-content/upgrade/ at the web-server level and confirming that visitors cannot list its contents.
Seven of the 17 advisories involve the Interactivity API, the system WordPress uses to add browser-side behaviour to blocks. Their shared root was KSES, the WordPress filtering system that controls which HTML users without unrestricted publishing rights may save. KSES permitted any data-* attribute and value, while Interactivity directives use attributes such as data-wp-interactive, data-wp-context and data-wp-bind--href. A Contributor could save those directives in a post, after which a visitor's browser would process them.
The resulting problems included bindings that created javascript: addresses, event-handler bindings already rejected by the PHP side, and reserved keys such as __proto__ entering a context merge and causing prototype pollution, which changes properties inherited by other browser objects. Other flaws allowed bindings on object elements to evade existing data and type checks. A CSS parser also repeated processing on every iteration, creating a denial of service that froze the visitor's browser tab rather than the server. Version 7.1.4 makes KSES remove bindings that would alter a validated value, restricts object-element bindings in the PHP directive processor and makes the browser runtime reject unsafe targets. The Interactivity browser runtime arrived in WordPress 6.4, one release before the PHP class in 6.5, so WordPress lists both versions as affected by the same number of issues.
Another flaw allowed post content to shadow Script Module data. The Interactivity API used getElementById(), which returns the first element carrying a requested ID regardless of its type. Because WordPress printed the genuine script data in wp_footer after the post, content with a matching ID could appear first and supply the runtime state. Version 7.1.4 now verifies that the selected element is actually a script element.
Two Customizer problems were also corrected. Selective refresh trusted data-customize-partial-* attributes in preview content and passed a supplied selector to jQuery's $() function. A value beginning with a less-than character could be treated as HTML to create rather than as a selector to search for. The fix uses .find(), which only interprets selectors. Separately, a preview request without a changeset UUID could adopt the latest unpublished changeset without checking who created it or whether the visitor had permission. This exposed its identifier and rendered preview anonymously, although changing its values still required the appropriate permissions. WordPress 7.1.4 now requires the customize capability.
Three block-related fixes address content being reinterpreted after filtering. The Categories block inserted a filtered dropdown label into a sprintf() format string, allowing formatting directives to expand afterwards. The Image and Playlist blocks used attacker-influenced text as a preg_replace() replacement, where PHP could expand references such as $0 and splice one tag into another tag's attribute. Both now use the HTML API. Comments Pagination and Post Navigation Link blocks now escape their label attributes before output.
The block delimiter flaw arose because the server's PHP parser and the editor's JavaScript parser disagreed about whitespace. JavaScript recognised non-breaking spaces, several Unicode spaces and a byte order mark that PHP did not. A specially formed delimiter could consequently be an inert comment on the server but a genuine block with attacker-controlled attributes in the editor. Version 7.1.4 restricts every parser to the same five whitespace characters.