WordPress.org released version 7.1.4 on October 28. It is a security release, and WordPress.org recommends updating immediately.

This follows 7.1.3 three weeks ago, which also fixed a batch of security flaws.

What was fixed

WordPress.org lists these issues:

  • A weakness in the upgrade process that can lead to remote code execution (an attacker running their own code on your server) during the upgrade window. Umut Bayram reported it.
  • Several stored cross-site scripting flaws (malicious script saved on your site and run in visitors’ or admins’ browsers). They affect the Interactivity API, the Categories block, the Playlist and image blocks, the comments pagination blocks, Customizer selective refresh, specially crafted user logins, and privacy data removal requests.
  • A stored denial of service issue in the Interactivity API, which could knock a page offline.
  • Unpublished Customizer changes that unauthenticated visitors could discover.
  • Notes that users without edit access to a post could still read.
  • Updated bundled root certificates, after the eMudhra revocation.

Anthropic, the WordPress security team, and outside researchers reported the flaws.

What to do

Open your Dashboard, click Updates, then Update Now. Sites with automatic background updates will update on their own.

WordPress.org says it is backporting the fixes to older branches, going back to 4.7. Those backports are still in progress. Only the most recent version is actively supported, so move to 7.1.4 if you can.

WordPress 7.2 Beta 3 also includes the fixes. The final 7.2 release is planned for December 8. If you are testing the 7.2 beta on a staging site, update to the latest beta.

End of article