WordPress 7.1.4 Fixes a Flaw in Its Own Update Process

WordPress released version 7.1.4 on 28 October, the fourth update since 17 September. The release announcement calls it a security release and says "it is recommended that you update your sites immediately."

The list of fixes is long and mostly technical. Most are cross-site scripting flaws, where specially crafted content in a block, a user login or a privacy request could run code in someone's browser. One is different: the announcement describes a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window. In plain terms, that is the moment an update is being installed, which is the one time you would least expect to be exposed. It also lists unpublished customizer changes that unauthenticated visitors could discover, and an update to the bundled root certificates.

The announcement does not say any of these flaws have been used against real sites, so there is no need to panic. It does say to update now, and that is a two minute job. Log in, open Dashboard, then Updates, and look at the version number. If it says 7.1.4, you are done. If it offers an update, take it. The announcement says sites that support automatic background updates will begin the update on their own, but whether yours does depends on how it is hosted, so check rather than assume.

Fixes are also being backported to older branches, through 4.7, and the announcement says those backports are still in progress. It repeats that only the most recent version of WordPress is actively supported. If your site is on a very old version, ask whoever looks after it about moving up, because waiting for a backport is not a plan.

If nobody owns the job of watching for these, our guide on keeping a small business website secure covers what to ask for. If you would rather hand it over, get in touch and we will talk through what looking after a site involves, with care plans from £69 a month.

The full guide: Is My Website Secure? What to Check