WordPress 7.1.4 fixes a remote code flaw under attack: update now

On this page

WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. Wordfence, a WordPress security company, reports that the most serious one is an unauthenticated race condition in the WordPress Core update process. It can lead to remote code execution, which means an attacker could run their own code on a site without needing to log in.

Wordfence also reports that threat actors are already actively attempting to exploit this flaw after the release. For this reason, site owners should verify that their WordPress is updated to 7.1.4 as soon as possible.

Who is affected

Any WordPress site that has not yet been updated to version 7.1.4 should be treated as a priority. This includes business websites, online shops running WooCommerce, and blogs. The flaw is in WordPress Core itself, not in a specific plugin or theme, so having few plugins does not remove the risk.

If your site updates itself automatically, it may already be on the fixed version, but you should still confirm it. If a developer, agency or host maintains your site, they may have already handled it, and it is worth asking them.

How to check your site

1. Log in to your WordPress admin area.
2. Go to Dashboard, then Updates. The page shows your current WordPress version and tells you whether a newer one is available.
3. You can also look at the bottom right of most admin pages, where the version number is usually displayed.
4. If you cannot log in, or you are not sure, contact your developer or your hosting provider and ask which WordPress version your site runs.

What to do now

1. Make a backup of your site and database if you can. Many hosts offer a one-click backup in their dashboard.
2. In Dashboard, then Updates, click the button to update to WordPress 7.1.4.
3. Once the update finishes, reload the Updates page and confirm that it says you have the latest version.
4. Open your site and test the main pages, the contact form and, if you sell online, the checkout.
5. If you rely on a developer or a managed host, send them a short message asking them to confirm that the site is on 7.1.4. Ask them to also check for anything unusual, such as unknown administrator accounts or files you do not recognise.
6. Keep plugins and themes updated too, and check the official WordPress release announcement for the full list of fixes.

Because exploitation attempts have been reported, do not wait for the next maintenance window. The update is the main protection described by the source.

This alert reports what the source published and is not a guarantee about any specific site.

Sources

• WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release