# WordPress 7.1.4 Security Release Patches 22 Vulnerabilities Including Core-Update Race Condition RCE and Multiple Stored XSS

> WordPress 7.1.4 (released 2026-10-28) fixes 22 vulnerabilities, including a race condition during core updates that could lead to remote code execution, numerous Contributor+/Author+/Editor+ stored XSS issues (largely in Interactivity API bindings), an unauthenticated disclosure of unpublished Customizer changes, and a comment-moderation permissions flaw. Backports were released for branches back to 4.7; no CVE IDs, CVSS scores or in-the-wild exploitation are published.

- **Published:** 2026-10-29T06:23:41Z
- **Last reviewed:** 2026-10-29T06:23:41Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4707
- **ID:** TL-2026-4707
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On October 28, 2026 the WordPress security team shipped WordPress 7.1.4 as a security release and recommended immediate updating. The release addresses 22 vulnerabilities, credited to HackerOne-program reporters including Anthropic, Rafie Muhammad (Awesome Motive), Antonio Lorensius Silaban, Umut Bayram, rekter0, Luis Herranz, Alex Concha, Weston Ruter, Ben Bidner, Jon Surrell, Anas cherni, Marcel Karlsson (whoismarcel) and Ramon of the WordPress Security Team. No CVE identifiers or CVSS scores were assigned in the vendor release notes or the GBHackers coverage, and neither source documents exploitation in the wild, public PoC code, or exploitation prerequisites.

The most severe item is a race condition during core updates that could lead to remote code execution (reported by Umut Bayram). The vendor notes list wp-admin/includes/class-wp-upgrader.php and wp-admin/includes/update-core.php among the revised files, consistent with the upgrade code path, but the notes do not describe the exploit mechanics. Public reporting states the weakness affects the upgrade process during its execution window.

The bulk of the release is client-side injection and privilege-boundary issues. Contributor+ stored XSS is fixed in: whitespace in block delimiters; Customizer selective refresh; javascript: URLs in Interactivity API bindings; Interactivity API event handler bindings; prototype pollution in Interactivity API context namespaces; and labels of the Comments Pagination and Post Navigation Link blocks. A separate Contributor+ Interactivity API bindings issue lets object elements load admin pages. Further Contributor+ XSS and denial-of-service issues in Interactivity API bindings were reported by rekter0, Marcel Karlsson, Jon Surrell and Alex Concha. An Author+ stored XSS exists in the Interactivity Router via uploaded text files, and an Editor+ stored XSS in the personal data erasure requests screen. A cross-site scripting issue in the Categories block arises from format string injection, and post content could shadow Script Module data using a matching element ID.

Other fixes: unauthenticated visitors could see unpublished Customizer changes (information disclosure); custom roles that moderate comments could read, edit and delete notes on posts they cannot edit; hardening for unescaped usernames on multisite Network Users screens; hardening for unsafe preg_replace() replacements in the Image and Playlist blocks; and an update to bundled root certificates because of the eMudhra revocation.

Branch exposure: 7.0 and 6.9 are affected by all 22 issues; 6.8 and 6.7 by 20; 6.6 by 19; 6.5 and 6.4 by 17; 6.3 through 5.9 by 9; 5.8 through 5.0 by 6; 4.9 by 4; 4.8 and 4.7 by 2. Fixed backports: 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18, 5.9.20, 5.8.19 down to 5.0.31, 4.9.35, 4.8.34 and 4.7.39. WordPress 4.6 and earlier receive no security updates. Severity HIGH is an analyst judgment based on the RCE class and the breadth of affected branches, not a vendor score.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1213 Data from Information Repositories
- T1499.004 Endpoint Denial of Service: Application or System Exploitation

## Sources

- [WordPress Version 7.1.4 release notes](https://wordpress.org/documentation/wordpress-version/version-7-1-4/)
- [WordPress 7.1.4 Security Release (wordpress.org News)](https://wordpress.org/news/2026/10/wordpress-7-1-4/)
- [WordPress 7.1.4 Security Update Patches 22 Vulnerabilities Affecting Millions of Websites (GBHackers)](https://gbhackers.com/wordpress-7-1-4-security-update/)
- [WordPress Version 7.0.8 release notes](https://wordpress.org/documentation/wordpress-version/version-7-0-8/)
- [WordPress Version 6.9.11 release notes](https://wordpress.org/documentation/wordpress-version/version-6-9-11/)
- [WordPress HackerOne vulnerability disclosure program](https://hackerone.com/wordpress?type=team)
- [WordPress 7.1.3 Maintenance and Security Release](https://wordpress.org/news/?p=21753)
- [Weak certificates from Indian CA cause cascade of updates (BankInfoSecurity)](https://www.bankinfosecurity.com/weak-certificates-from-indian-ca-cause-cascade-updates-a-33166)
- [eMudhra faces scrutiny after weak certificate keys raise web security concerns (YourStory)](https://yourstory.com/2026/10/emudhra-faces-scrutiny-after-weak-certificate-keys-raise-web-security-concerns)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4707