WordPress 7.1.4: 7 Essential Fixes You Need Now (2026)

WordPress 7.1.4 is a critical, out-of-cycle security release that patches an unauthenticated remote code execution flaw, tracked as CVE-2026-119977, in the core update process itself. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on November 3, 2026, after confirming active attacks in the wild. If your site has not auto-updated yet, patching it is the single most important thing you can do today.

What vulnerability does WordPress 7.1.4 fix?

WordPress 7.1.4 fixes a race condition in WordPress Core’s own update mechanism, tracked as CVE-2026-119977 and classified under CWE-367 (Time-of-check Time-of-use). The flaw carries a CVSS score of 8.1 and affects every WordPress Core release from 4.7 through 7.1.3 — effectively every site that hadn’t already applied this patch. Because the bug lives in the upgrade routine rather than in a plugin or theme, it was exploitable on stock WordPress installs with no third-party code involved.

Security researchers describe the exploit as opening a brief window during a core update where an attacker can race the file-write process and smuggle in malicious code before WordPress finishes verifying the new files. That makes it an unauthenticated RCE: no login, no admin account, and no vulnerable plugin required. WordPress shipped the fix in version 7.1.4 and backported it down through every supported branch, all the way to 4.7.39. The official WordPress 7.1.4 version documentation lists the full technical changelog if you want to verify exactly what shipped.

How does the WordPress 7.1.4 race condition actually work?

A race condition happens when two operations that touch the same resource run close enough in time that their order isn’t guaranteed, and the software’s safety checks assume an order that doesn’t always hold. In WordPress’s case, the core updater checks downloaded files, then writes them to disk in a separate step. The gap between “check” and “write” — the time-of-check-to-time-of-use window that gives CWE-367 its name — is where CVE-2026-119977 lives.

An attacker able to influence what lands in that gap, during the moment a site’s update routine runs, could get unverified code written into the filesystem as though it had passed WordPress’s checks. Exactly how attackers trigger the race on a live target hasn’t been published in detail, which is normal for an actively exploited flaw — publishing a working proof-of-concept would only help more attackers automate it. What is published, and confirmed by multiple independent security researchers, is that the race condition is real, it’s reachable without authentication, and WordPress 7.1.4 closes it.

Why is CISA treating this as an emergency?

CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalog on November 3, 2026, which means it has verified evidence of real-world attacks rather than theoretical risk. Federal agencies running affected systems were given a remediation deadline of November 6, 2026 — a three-day window that signals how seriously the agency rates the threat. For everyone outside federal government, the same deadline is a useful rule of thumb for how urgently to act.

WordPress security firm Wordfence reported blocking more than 13,000 attack attempts targeting this exact vulnerability within a 24-hour window shortly after disclosure. That volume tells you the flaw is being scanned for and exploited automatically, at scale, by bots — not hand-picked by attackers targeting your site specifically. Sites that stay unpatched are exposed to the same automated sweep as every other outdated WordPress install on the internet. Security firm Patchstack’s analysis of the release breaks down the full list of fixed advisories if you want the technical detail behind each one.

Timeline: how the WordPress 7.1.4 release unfolded

The sequence matters because it shows how fast this moved from “patch available” to “actively exploited and flagged by a federal agency.” WordPress shipped version 7.1.4 on October 28, 2026, as a routine-looking point release. Four days later, on November 2, the Make WordPress blog detailed Gutenberg 24.3, which bundled the same fixes for the standalone plugin. The following day, November 3, CISA added CVE-2026-119977 to its KEV catalog after confirming exploitation in the wild, with a remediation deadline of November 6 for federal systems.

• October 28, 2026 — WordPress 7.1.4 released, patching CVE-2026-119977 and backporting the fix to every supported branch.
• November 2, 2026 — Gutenberg 24.3 published, carrying the same security fixes for Gutenberg plugin users.
• November 3, 2026 — CISA adds CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, citing confirmed active exploitation.
• November 6, 2026 — Federal remediation deadline for agencies running affected systems.

Less than a week passed between the quiet patch release and a federal agency confirming it was already being used in attacks. That compressed window is exactly why security teams treat a KEV listing as a signal to stop deprioritizing an update, regardless of how routine the version number looks.

What else does WordPress 7.1.4 patch?

Beyond the headline RCE, WordPress 7.1.4 bundles a batch of smaller but still meaningful fixes. These include several stored cross-site scripting (XSS) issues, a permissions bug that let custom comment-moderator roles read, edit, and delete notes on posts they shouldn’t have access to, and an update to WordPress’s bundled root certificates after an eMudhra certificate was revoked. None of these are as severe as CVE-2026-119977 on their own, but each closes a door that a determined attacker could otherwise use.

The stored XSS fixes matter because they let an attacker who can submit content to your site — through a comment form, a contributor account, or a weakly-sanitized custom field — plant JavaScript that runs in an administrator’s browser the next time they view the affected page. The comment-moderator permissions bug is narrower but still real: a role meant only to approve or reject comments could read, edit, and delete private notes attached to posts outside that role’s intended scope, which is a quiet way to leak information on multi-author sites.

The certificate update is routine housekeeping by comparison — eMudhra’s root certificate was revoked industry-wide, and WordPress 7.1.4 swaps in the replacement so HTTPS requests made by WordPress itself (for update checks, API calls, and remote requests) don’t start failing.

WordPress also backported the fix across every actively supported branch rather than forcing sites onto the newest minor version. The table below shows how far back the patch reaches.

If your host or management tool reports a version older than the patched release for your branch, your site is still exposed. Our WordPress 7.0.4 security update walks through an earlier core patch using the same backport pattern, which is worth comparing if you’re trying to understand how WordPress’s release branches work.

How do you update to WordPress 7.1.4 safely?

Updating to WordPress 7.1.4 safely takes four steps: back up your site, trigger the update, confirm the version number changed, and re-check your plugins. Start with a full backup — files and database — using whatever backup plugin or host-level snapshot tool you already have, since a security patch is not the moment to skip your safety net. Most managed WordPress hosts also keep their own snapshots, so check there first if you don’t run a dedicated plugin.

Next, trigger the update itself. Go to Dashboard → Updates in wp-admin and click “Update Now” if WordPress hasn’t already auto-applied the patch (minor security releases like this one are usually pushed automatically). Once it finishes, reload Dashboard → Updates or check Dashboard → At a Glance to confirm the version reads 7.1.4, or the correct patched point-release for your branch. If you manage several sites, our WordPress plugin security audit guide covers how to check update status and plugin vulnerabilities across a whole fleet of sites at once.

Finally, since the flaw lived in the update process itself, verify that the update actually completed cleanly rather than stalling partway through. Clear any page or object caches afterward, and spot-check that your site still loads and that wp-admin logs in normally. If you’re on a WordPress 7.1.x branch, it’s also worth reading through our WordPress 7.1 breaking changes rundown, since some of those behavior changes are easy to mistake for update problems if you haven’t seen them before.

A quick checklist for the WordPress 7.1.4 update

Use this short checklist before and after you apply the patch, especially if you manage more than one WordPress install.

• Take a full backup (files and database) before touching anything.
• Confirm whether your host already auto-applied WordPress 7.1.4, since minor security releases often roll out automatically.
• If it hasn’t, update manually from Dashboard → Updates and wait for the process to finish without interruption.
• Re-check Dashboard → At a Glance to confirm the version number matches the patched release for your branch.
• Clear any page, object, or CDN caches so visitors aren’t served a stale, pre-update version of your site.
• Re-scan with your security plugin of choice to confirm no injected files were left behind from before the patch.
• Repeat across every site you manage — a WordPress 7.1.4 update on one install says nothing about the others.

What if you can’t update WordPress 7.1.4 right away?

If you can’t apply WordPress 7.1.4 immediately — because of a custom hosting workflow, a staging gate, or a plugin compatibility check — put mitigations in place while you wait rather than leaving the site fully exposed. A web application firewall (WAF) with up-to-date WordPress-specific rules, such as those offered by Wordfence or your host’s security layer, can block known exploit patterns targeting this vulnerability even before the core update lands.

You can also temporarily restrict who can trigger core updates, since the race condition is exploited around the update process itself: disable any public-facing update endpoints, limit wp-admin access by IP where feasible, and avoid running updates during high-traffic windows when you can’t closely monitor the result. None of these replace the patch — they only narrow the window of exposure until you can apply WordPress 7.1.4 properly.

Managed hosts often handle this entire problem for you by forcing minor security releases regardless of your own update settings, which is one of the stronger arguments for managed WordPress hosting during a high-severity disclosure like this one. If you’re on shared or self-managed hosting and unsure whether automatic updates are even enabled, check wp-config.php for a WP_AUTO_UPDATE_CORE constant, or ask your host directly rather than assuming the patch applied itself.

Does Gutenberg 24.3 include the WordPress 7.1.4 fixes?

Yes — Gutenberg 24.3, released October 28, 2026 and detailed on the Make WordPress blog on November 2, bundles the same security fixes shipped in WordPress 7.1.4 for sites running the Gutenberg plugin standalone. That matters for anyone testing upcoming block editor features ahead of the next core release, since running an older Gutenberg plugin version alongside a patched core doesn’t fully close the gap on its own.

Gutenberg 24.3’s headline editing feature lets you apply text formatting — bold, italics, links — across multiple selected blocks in a single action, instead of formatting each paragraph or heading block separately. It also displays certain media selections as a grid view and stops background videos from autoplaying when a visitor has “reduce motion” enabled in their system settings, a small but meaningful accessibility fix. Building the plugin from source now requires Node.js 22, and the release itself still requires WordPress 7.0 or higher and PHP 7.4 or higher to run. If you’re tracking the editor roadmap, our WordPress 7.2 features preview covers what’s planned for the next major core release this December.

Does this affect WordPress multisite networks?

Yes, and arguably with higher stakes. A WordPress multisite network shares one core installation across every site in the network, which means a single unpatched core on the main site leaves every subsite exposed to the same race condition. There’s no way for an individual subsite administrator to patch around it independently — only a network administrator with access to the core files can apply WordPress 7.1.4 across the whole network.

If you run or manage a multisite network, treat this the same way you’d treat any shared-infrastructure vulnerability: one missed update anywhere in the chain puts every site on that network at risk, not just the one that happens to be out of date. Coordinate with whoever holds network-admin access and confirm the update went through network-wide, not just on the primary domain, before you consider the network secure.

Agencies, universities, and media companies running large WordPress multisite deployments are exactly the kind of target that makes a KEV-listed, unauthenticated RCE attractive to attackers: one successful exploit against a shared core can translate into access across dozens or hundreds of individual sites at once. That’s a strong reason to prioritize WordPress 7.1.4 on network installations ahead of smaller single-site updates, if you’re triaging a long list.

The bottom line on WordPress 7.1.4

Strip away the CVE numbers and KEV deadlines, and the situation is simple: a core WordPress bug let attackers run code on sites without logging in, it’s being exploited right now, and the fix has existed since October 28, 2026. Every day a site stays on an older version is a day it sits inside the pool of targets that automated attack tools are already sweeping. There’s no workaround that fully replaces the patch itself.

Whether you run one blog or manage a network of client sites, the same short list applies: confirm your version, back up, update, and verify. It’s a routine WordPress maintenance task that happens to carry unusually high stakes this time, and treating it with that urgency — rather than filing it away as “just another point release” — is the real takeaway from WordPress 7.1.4.

Frequently Asked Questions

What is CVE-2026-119977?

CVE-2026-119977 is a race condition in WordPress Core’s update mechanism (CWE-367) that can allow unauthenticated remote code execution during a core update. It carries a CVSS score of 8.1, affects WordPress versions 4.7 through 7.1.3, and is fixed in WordPress 7.1.4 and its backported equivalents.

Is WordPress 7.1.4 safe to install immediately?

Yes. WordPress 7.1.4 is a security-focused point release with no major feature changes, so the usual update caution mostly applies to your plugins and theme, not to core itself. Back up first, then update — the risk of staying unpatched against an actively exploited flaw outweighs the small risk of an update hiccup.

Does this vulnerability affect WordPress.com or only self-hosted sites?

CVE-2026-119977 affects the WordPress Core software, which means self-hosted (WordPress.org) sites running an unpatched version are at risk. Fully managed WordPress.com sites are typically updated centrally by Automattic, so self-hosted site owners carry the responsibility for applying WordPress 7.1.4 themselves.

What should I do if I can’t update right away?

Put a web application firewall with current WordPress rules in front of your site, restrict access to update-related functionality where possible, and schedule the WordPress 7.1.4 update as soon as your workflow allows. These steps reduce exposure but don’t eliminate it, so treat them as temporary, not as a substitute for patching.

Does Gutenberg 24.3 replace the need to update WordPress core?

No. Gutenberg 24.3 bundles the same fixes for sites running the standalone Gutenberg plugin, but it doesn’t patch WordPress Core itself. If you run Gutenberg as a plugin on an older core version, you still need to update to WordPress 7.1.4 (or your branch’s backported equivalent) separately.

How can I check which WordPress version my site is running?

Log into wp-admin and check Dashboard → At a Glance, or the bottom-right corner of most admin screens, both of which display the current WordPress version. You can also view your site’s source code and search for “generator” in the page head, though many security plugins hide this tag for exactly this reason.