WordPress 7.1.4: update your personal site for 22 security fixes

If you run your own WordPress blog, a hobby site, a church page, or a personal project on self-hosted WordPress, treat WordPress 7.1.4 as a same-day update. It is a security release, not a feature drop you can park for next weekend.

WordPress.org shipped 7.1.4 on October 28, 2026. The release, led by Aaron Jorbin and Nik Tsekouras, fixes multiple security issues, and WordPress recommends updating sites immediately from Dashboard > Updates, or downloading the release and applying it the way you usually update. Automatic background updates may already be running if you left them on. Still log in afterward and confirm the version yourself.

This is a different package from WordPress 7.1.3 (October 6) and from WordPress 7.1.2. Same habit either way: get on the new build and prove it stuck.

What this release is

The official WordPress.org news post lists the security fixes, and the version 7.1.4 HelpHub page counts 22 vulnerabilities in total. WordPress calls it a short-cycle release. The next big version, 7.2, is currently planned for December 8, 2026. You do not need to wait for 7.2 to pick up these fixes.

You do not need to read every entry to decide. If your dashboard still shows 7.1.3 or older, you are behind. Update, then verify.

Why the security fixes matter at home

WordPress credits several reporters for the issues fixed in this build. In plain language, the kinds of problems closed here include:

• A weakness in the WordPress upgrade process (HelpHub describes it as a race condition during core updates) that can lead to remote code execution during the upgrade window (reported by Umut Bayram)
• Multiple stored cross-site scripting (XSS) issues, including specially crafted block markup, Privacy Data Removal Requests, Customizer selective refresh, the Categories block, Playlist and image blocks, comments pagination blocks, several in the Interactivity API, and specially crafted user logins
• A stored denial of service issue in the Interactivity API
• Unauthenticated discovery of unpublished Customizer changesets
• Notes readable by certain privileged users who cannot edit the post the note is attached to
• An update to the bundled root certificates after the eMudhra revocation (see our eMudhra CA note if you want the browser side of that story)

You do not need to reproduce any of that on your live site. You need the patched core. A small personal blog is not a reason to skip a security release. Attackers do not care that you only post recipes.

WordPress also notes these security fixes are being backported as a courtesy to older branches that still receive security updates (currently back to 4.7), while reminding everyone that only the newest WordPress version is actively supported. The HelpHub page lists patched builds such as 7.0.8, 6.9.11, and 4.7.39, and says WordPress 4.6 and earlier no longer get security updates. If you are still on a very old version, take the patched build for that branch if it ships, and plan a real upgrade path instead of another year of “it still loads.”

WordPress 7.2 Beta 3 also includes the applicable fixes for people already testing the next version. That does not replace updating a production personal site on 7.1.

Update WordPress 7.1.4 now

1. Backup first if your host does not already snapshot before updates. Files plus database, something you can restore.
2. Open Dashboard > Updates.
3. Confirm WordPress core shows 7.1.4 available (or that you are already on it).
4. Click Update Now and wait for the success screen. Do not close the tab partway through.
5. If automatic background updates are enabled, they may already be applying. Still log in afterward and verify. Automatic updates help, but check anyway.
6. If the dashboard cannot reach the updater, download 7.1.4 from WordPress.org / the releases page and follow your host’s manual update path, or use WP-CLI if you already know that workflow.
7. If your host holds back WordPress updates, contact their support with a screenshot of Dashboard > Updates and ask them to allow 7.1.4.

Confirm it stuck

After the update:

1. Check Dashboard > Updates (or At a Glance) for the running version. You want 7.1.4.
2. Load the front page and one editor screen. Spot-check a post and a media upload if you use those often.
3. If you maintain more than one personal site, write down which domains you updated. Forgotten test copies and old project sites are how “I thought I patched” turns into a mess.

Do / don’t

Do

• Update the same day when WordPress ships a security release
• Verify the version after auto-update claims success
• Keep unused themes and plugins deleted, not merely deactivated
• Ask your host for help if the panel blocks the update

Don’t

• Skip the update because “it is only a personal blog”
• Wait for 7.2 to pick up these fixes
• Hunt for exploit writeups instead of clicking Update Now
• Assume a very old version is fine forever just because backports exist

Bottom line

WordPress 7.1.4 (October 28, 2026) is a security release with 22 fixes, including an upgrade-window remote code execution risk and a batch of stored XSS issues (official WordPress.org news post, version docs). From Dashboard > Updates, install 7.1.4, confirm the version stuck, and move on. That is the whole job for a home or personal WordPress site.

Image: Official WordPress standard logotype (wordpress.org/about/logos) on a white background.