WordPress, October 2026

WordPress 7.1.4 is a security release. Here's what site owners should do.

WordPress 7.1.4 came out on 28 October 2026 with fixes for 22 security flaws, and WordPress.org says to update immediately. On 29 October, the security company Wordfence reported that attackers are already trying to exploit one of them, and on 3 November the US cyber agency CISA added that flaw to its list of actively exploited vulnerabilities. Sites on the older 7.0 and 6.9 lines get the same kind of fixes in 7.0.8 and 6.9.11. If your website runs on WordPress, or you're not sure, here is how to check your version, whether it updates by itself, and what to check after.

Ask us to check your site Jump to the steps

Published 28 October 2026Last updated 4 November 2026Written by the Penguina team

What changed

22 security fixes in one small update.

WordPress.org released 7.1.4 on 28 October 2026 at 17:13 UTC. It is a security release, so it fixes weaknesses rather than adding features. The fixes include:

A weakness during updates that could let an attacker run their own code on a site while it is being upgraded. Wordfence rates it 8.1 out of 10 (High), says it affects WordPress 4.7 to 7.1.3, and reported on 29 October that attackers are trying to exploit it. On 3 November 2026, CISA added it to its list of actively exploited flaws.
Stored cross-site scripting (XSS) issues, where harmful script saved into a site could run in a visitor's or admin's browser.
Customizer changesets that could be exposed, meaning unpublished design changes made in the Customizer could be found by visitors who aren't logged in.
An updated list of trusted root certificates, which WordPress uses for secure connections, after a revocation involving the certificate authority eMudhra.

The WordPress.org release post lists the fixes in groups. Wordfence, Patchstack and HOL count 22 vulnerabilities in total. The next big release, WordPress 7.2, is planned for 8 December 2026.

Which version you need

Is your site on a fixed version?

From WordPress.org's version check and releases page. To see your version, log in to WordPress and go to Dashboard > Updates.

Fixed versions

7.1 line: 7.1.4
7.0 line: 7.0.8
6.9 line: 6.9.11
6.8 line: 6.8.12
6.7 line: 6.7.11
6.6 line: 6.6.11
6.5 line: 6.5.14

If your site shows one of these numbers, or anything newer, it has the fixes.

Needs updating

7.1.3 or earlier on the 7.1 line
7.0.7 or earlier on the 7.0 line
6.9.10 or earlier on the 6.9 line
6.8.11 or earlier on the 6.8 line
6.7.10 or earlier on the 6.7 line
6.6.10 or earlier on the 6.6 line
6.5.13 or earlier on the 6.5 line

WordPress 6.4 and older have no fix release yet. WordPress.org says the fixes are being brought to older lines still eligible for security updates, currently back to 4.7, and will ship as they're ready. If your site runs 6.4 or older, check Dashboard > Updates or ask your developer, and plan a move to a current version.

Not sure your site runs WordPress? If adding /wp-admin/ to the end of your web address shows a WordPress login page, it does. Sites built on Wix, Squarespace, Shopify or Webflow don't run WordPress, so this release doesn't apply to them.

What to do today

Three steps for site owners.

If a developer, agency or host looks after your site, send them this list and ask them to confirm the version when they're done.

Check your version

Log in and open Dashboard > Updates. WordPress.org says sites that support automatic background updates will start this update by themselves, but a host, developer or plugin can turn that off. So check rather than assume.

Back up, then update

If you're not on a fixed version, take a full backup of your files and database first. Then click Update to version 7.1.4 on the same screen, or ask your host to update it.

Check the things that earn you money

Open your home page and a few key pages, log in, send a test through your contact form, and test your booking or checkout. If anything looks wrong, restore the backup and get help.

Updating WordPress itself does not update your plugins or theme. While you're in Dashboard > Updates, update those too.

A security plugin is not a substitute for updating. Wordfence says users of its free plan get a firewall rule for the update flaw on 27 November 2026 (paid users got it on 28 October). Patchstack says a firewall inside WordPress can't block this flaw, and that the web server should block access to the wp-content/upgrade/ folder. If you're not sure yours does, ask your host.

What we don't know

What nobody has said yet.

Whether attacks are working: on 29 October 2026, Wordfence reported that attackers are already actively attempting to exploit the update flaw. On 3 November 2026, the US cyber agency CISA added the flaw (CVE-2026-119977) to its Known Exploited Vulnerabilities list, which it says is based on evidence of active exploitation, and gave US federal agencies until 6 November to fix it. CISA hasn't said who is attacking, which sites were targeted or whether attacks succeeded. Patchstack and HOL had reported no exploitation as of 28 October, before Wordfence's report.
Whether your site updated by itself: only a look at your own dashboard can tell.

Update, 3 November 2026: CISA now lists the update flaw as actively exploited. Before this update, this page said the flaw was not on that list as of 29 October. The advice is the same, and more urgent: if your site isn't on a fixed version, back up and update today. We'll update this page if WordPress.org, CISA or security companies publish more.

If you updated late

If your site wasn't updated straight away, check for signs.

Updating closes the hole, but it doesn't remove anything an attacker may have left before you updated. If your site stayed on an old version after 28 October 2026, TrendAI suggests checking for these:

Admin accounts you don't recognise: in your dashboard, open Users and look at everyone with the Administrator role.
Plugins you didn't add: open Plugins and look for any name that you, your developer or your host didn't install.
PHP files in wp-content/upgrade/ that nobody put there: ask whoever looks after your hosting to check that folder for PHP files that you, your developer or your host didn't place.
Requests to the wp-content/upgrade/ folder: this one is for your host or whoever runs the server. TrendAI says a request in the server logs on its own only shows someone tried. What matters is whether a request succeeded during an update.

Once your site is on a fixed version, it's also worth running a malware scan.

If your host finds a request that succeeded during an update, TrendAI says to treat it as a break-in and assume code ran on the server: change your WordPress admin passwords and your database password, and have the site checked for web shells, which are hidden files that let someone back in. If you find an admin account, plugin or file nobody added, get help straight away. Start a chat and tell us your website address if you'd like us to look with you.

As of 3 November 2026, TrendAI said no successful break-in had been reported. Finding none of these signs is good news, but it isn't a guarantee.

When to get help

Get help now if any of these are true.

You can't log in to your WordPress dashboard, or don't know who can.
The update failed, or your site looks broken after it.
Your site runs WordPress 6.4 or older, which has no fix release yet.
You found one of the signs in the check above.
Nobody is looking after your site right now.

We look after small business websites in the US, UK, Canada and Australia. Your first fix is free. Start a chat and tell us your website address.

Questions

Questions site owners ask.

Something else? Ask in the chat or email hello@penguina.website.

Do I need to do anything about WordPress 7.1.4?

Check your version first. In your WordPress dashboard, go to Dashboard > Updates. If it says 7.1.4, or 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11 or 6.5.14 on an older line, you already have the fixes. If it shows an older number, back up your site and update now. WordPress.org says to update immediately.

Will WordPress update itself to 7.1.4?

Often, yes. WordPress.org says sites that support automatic background updates will start this update by themselves. But a host, developer or plugin can turn that off. So don't assume: check Dashboard > Updates.

Is anyone attacking the flaws fixed in WordPress 7.1.4?

Yes. On 29 October 2026, the security company Wordfence reported that attackers are already actively attempting to exploit the flaw that can let someone run code on a site during an update. On 3 November 2026, the US cyber agency CISA added that flaw to its Known Exploited Vulnerabilities list, based on evidence of active exploitation, and gave US federal agencies until 6 November to fix it. CISA hasn't said who is attacking or which sites were targeted. Patchstack and HOL had reported no exploitation as of 28 October, before Wordfence's report. Don't wait: update now.

My site runs WordPress 7.0 or 6.9. Is there a fix for me?

Yes. WordPress.org's version check lists 7.0.8 for the 7.0 line and 6.9.11 for the 6.9 line. WordPress.org has also released 6.8.12, 6.7.11, 6.6.11 and 6.5.14 for those older lines, all dated 28 October 2026. WordPress 6.4 and older have no fix release yet. WordPress.org says fixes for older lines still eligible for security updates, currently back to 4.7, will ship as they're ready. If your site runs 6.4 or older, check Dashboard > Updates or ask your developer, and plan a move to a current version.

Will updating to 7.1.4 break my site?

A security release like this is small, so most sites update without trouble. Still, take a backup first. After updating, open your home page, log in, send a test through your contact form, and test your booking or checkout.

Does this affect Wix, Squarespace, Shopify or Webflow sites?

No. WordPress 7.1.4 is a release of WordPress only. Sites built on Wix, Squarespace, Shopify or Webflow don't run WordPress.

Keep reading

Sources for this page