WordPress 7.1.4 Security Release Fixes an Updater Flaw and More
Fixes are being backported to eligible security branches, currently through WordPress 4.7.
WordPress 7.1.4 fixes 22 vulnerabilities, by Search Engine Journal’s count, including an updater flaw that could allow remote code execution. The WordPress team recommends updating immediately.
Search Engine Journal counts 22 vulnerabilities. The official list breaks the fixes out one by one, and one entry covers multiple stored XSS issues in the Interactivity API.
Do you manage WordPress sites? Check each one today.
What the release fixes
The updater flaw, reported by security researcher Umut Bayram, could lead to remote code execution during the upgrade window, and it’s the one to take seriously.
Search Engine Journal calls it a race condition.
Search Engine Journal’s report on the update weakness says the conditions needed to exploit it remain unclear.
Beyond the updater, the release fixes stored cross-site scripting issues in these parts of WordPress:
- blocks
- the Interactivity API
- the Customizer
- comments pagination
The official WordPress 7.1.4 announcement and fix list also includes issues involving playlists, image blocks, logins and privacy data removal requests.
Some flaws could expose information, and many require Contributor-level access or higher, according to Search Engine Journal, which narrows who can trigger those issues on your site.
Still, you’ll need to patch.
WordPress says the fixes are being backported to eligible security branches, currently through version 4.7, and the release updates bundled root certificates after an eMudhra revocation.
Check every site you manage
Sites that support automatic background updates should update automatically, while for a manual update WordPress says to:
- Open the WordPress Dashboard.
- Click Updates.
- Click Update Now.
But check each site anyway.
If you manage client installs, confirm the version in every dashboard after updating.
WordPress 7.1.4 is a short-cycle release, and version 7.2 is planned for December 8, WordPress 7.2 Beta 3 already contains all applicable fixes.
Don’t wait for the next major release.
Why it matters
As the updater flaw shows, even the tool that keeps your site current can have security problems, and a neglected update can leave your site exposed.
That can disrupt publishing, lead generation or sales.
I’d update today. Then check the sites you rarely log into.
Does a developer or host maintain WordPress for you? Ask them to confirm that 7.1.4 or an eligible patched branch is installed on your sites.
How exposed is your site? I can’t tell you yet, because the official announcement doesn’t explain the conditions needed to exploit the updater issue.
So patch promptly instead of guessing.
Common Questions
What should you do after WordPress 7.1.4 was released?
Open your WordPress dashboard, go to Updates, and install 7.1.4. Then confirm the version in every dashboard you manage.
Does WordPress 7.1.4 fix vulnerabilities in older versions?
WordPress says fixes are being backported to eligible security branches, currently through version 4.7, though only the latest WordPress version is actively supported.
What is the WordPress updater vulnerability?
It’s a weakness in the upgrade process that could lead to remote code execution during the upgrade window. WordPress hasn’t published the conditions needed to exploit it.
