WordPress 7.1.4 Update: What Trade Shops Should Check This Week

By Reid Casey · Last checked: Nov. 3, 2026, 4:35 PM ET, against 7 sources.

Short answer: On Oct 28, 2026, WordPress.org released WordPress 7.1.4 and says "it is recommended that you update your sites immediately." It fixes a flaw that "can lead to remote code execution during the upgrade window." CISA added it to its Known Exploited Vulnerabilities catalog on Nov. 3, 2026, "based on evidence of active exploitation." If your shop's site runs on WordPress, check this week that the update went through.

Key takeaways

• WordPress.org released 7.1.4 on Oct 28, 2026, and its HelpHub release page lists 24 fixed releases for older versions, from 7.0.8 back to 4.7.39.
• Wordfence, a security vendor, reported attempts to exploit the update flaw in a post on Oct. 29, 2026, based on its own data (vendor data).
• CISA added this flaw, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog on Nov. 3, 2026, "based on evidence of active exploitation." CISA marks its use in ransomware campaigns as "Unknown."

What did WordPress fix in 7.1.4?

WordPress 7.1.4 is a security release that WordPress.org published on Oct. 28, 2026, and it recommends updating immediately. It fixes 22 vulnerabilities, including a flaw in the update process that can lead to remote code execution. CISA now lists it as a known exploited vulnerability.

WordPress.org's release post went up at 1:13 PM ET on Oct 28, 2026. It lists the serious one as "A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window, reported by Umut Bayram." Put simply, the risk sits in the short stretch while the site updates itself.

HelpHub says "WordPress 7.0 is affected by all 22 vulnerabilities."

Sites that support automatic background updates shouldn't need a person to start it. WordPress.org says: "If you have sites that support automatic background updates, the update process will begin automatically." Older versions get the fixes too, backported "to all branches eligible to receive security fixes (currently through 4.7)."

HelpHub lists a fixed release for every version from 7.0.8 back to 4.7.39. The release post still said this when we checked at 6:24 PM ET on Oct 29: "The backports are in progress and will ship as they become ready."

Is anyone exploiting it?

Yes, according to CISA. CISA added this flaw to its Known Exploited Vulnerabilities catalog on Nov. 3, 2026, "based on evidence of active exploitation." Before that, Wordfence's post, published at 5:58 PM ET on Oct 29, 2026, said "threat actors are already actively attempting to exploit the vulnerability." Neither CISA nor Wordfence names a hacked site or says how many sites were targeted.

The numbers below are Wordfence's own data, so treat them as vendor data we can't check ourselves. "During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths," Wordfence wrote. It adds right away: "Not every request used the exact vulnerable path."

Wordfence rates the flaw "8.1 (High)" on the CVSS scale (vendor data). That score is Wordfence's. WordPress.org publishes none.

Pulling this off takes a lot. Per Wordfence: "The attacker needs a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to complete the attack before WordPress cleans up the temporary files." On Oct. 28, before CISA's listing, Patchstack rated the attack complexity as high, "which is why we scored it AC:H and would not call it practical to exploit" (vendor data).

CISA, the federal cybersecurity agency, added it to its Known Exploited Vulnerabilities catalog on Nov. 3, 2026, "based on evidence of active exploitation." CISA marks its use in ransomware campaigns as "Unknown." The Nov. 6, 2026 due date is for federal civilian agencies: CISA says its directive, BOD 26-04, "applies only to FCEB agencies," and it "encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities." NVD, the federal vulnerability database, lists the record, CVE-2026-119977, as "Undergoing Analysis." NVD hasn't scored it itself. The 8.1 score on it comes from Wordfence.

What does it mean for an electrician, plumber or HVAC shop on WordPress?

Your website is where a homeowner with a tripped breaker, a water heater that quit or a dead AC finds your number or fills out a quote form. If that site runs on WordPress, this release applies to you. WordPress.org says sites with automatic background updates start updating on their own. Wordfence still says to check.

Its exact words: "we strongly recommend checking your site rather than assuming the update completed" (vendor data). For a shop owner, that check is the first job this week.

TechStackRx's own analysis: four questions for your web person. We turned Wordfence's list of what an attacker needs and Patchstack's recommended fix into four plain questions. This adds no new data.

1. Is the site on WordPress 7.1.4, or on the fixed release for its version (for example 7.0.8 or 6.9.11)? Source: HelpHub.
2. When WordPress last updated itself, was it a full-package update? Wordfence says an attack "needs a full-package update containing the installer files" (vendor data).
3. Can anyone on the internet reach the wp-content/upgrade/ folder? Patchstack advises: "deny access to wp-content/upgrade/" (vendor data).
4. Can a visitor see a list of the files in that folder? Patchstack says to "check the directory is not listable" (vendor data).

If the answers are "yes, updated" and "no, it's blocked," you've covered the update and the folder block that Wordfence and Patchstack point to.

What to do this week

What should you do this week? Start with step 1.

1. Open Dashboard > Updates and confirm you're on 7.1.4 or your version's fixed release, such as 7.0.8 (HelpHub).
2. On WordPress 4.6 or older? Plan an upgrade. HelpHub says those versions "no longer receive security updates."
3. Ask your host or web person to block web access to wp-content/upgrade/. That's Patchstack's fix (vendor data); asking them is our advice.
4. Don't count on a firewall plugin instead of the update. Patchstack says "A PHP firewall cannot block it," and Wordfence says its rule "does not replace installing the security update" (vendor data).
5. If the site sat unpatched, have them look for "unfamiliar administrator accounts, unexpected plugins, or PHP files you did not place there," per Wordfence (vendor data).
6. Optional: Patchstack suggests you "check who holds Contributor and above" on the site (vendor data).

What we don't know yet

• How many sites were targeted, and by whom. CISA lists the flaw as exploited but gives no count and names no attacker, and it marks ransomware use as "Unknown."
• Whether every older-version package is out. WordPress.org's release post still says "The backports are in progress and will ship as they become ready."
• Whether WordPress.org will say more. Its release post doesn't mention exploitation as of Nov. 3, 2026, 4:35 PM ET.

Reid's take

My rule: don't assume your site updated. Check it. Log in, open Dashboard > Updates, and look for 7.1.4 or the fixed release for your version. Wordfence gives the same advice. No login? Ask whoever has it, and get the version number back in writing. Then you know it's done.

Start Diagnosis → · 2-minute diagnostic

Related on TechStackRx

• PHP2Shell: What to Ask Your Web Host
• Missed calls and revenue

Caveats and methodology

• We read WordPress.org's release post and HelpHub page, Wordfence's post, Patchstack's post, CISA's catalog and alert, the CVE record and NVD on Nov. 3, 2026, 4:35 PM ET. Wordfence's page blocks automated reads, so we used its own feed.
• Wordfence and Patchstack figures are their own reporting, marked as vendor data. The four questions and "ask your host" steps are our advice.
• We sell, too. TechStackRx sells lead follow-up automation, 24/7 voice agents and CRM setup for home-service businesses.

Frequently asked questions

What is WordPress 7.1.4?

It's a security release WordPress.org published on Oct. 28, 2026. WordPress.org says "it is recommended that you update your sites immediately." HelpHub says it fixes 22 vulnerabilities, including a flaw in the update process that can lead to remote code execution.

Is anyone exploiting the WordPress 7.1.4 flaw?

Yes, according to CISA. CISA added it to its Known Exploited Vulnerabilities catalog on Nov. 3, 2026, "based on evidence of active exploitation," and marks ransomware use as "Unknown." Earlier, Wordfence, a security vendor, reported "more than 18,500 requests targeting staged setup-config.php installer paths" in the first 21 hours, and said "Not every request used the exact vulnerable path" (vendor data). Neither names a hacked site.

How do I check that my WordPress site updated?

Open Dashboard > Updates and look for 7.1.4 or your version's fixed release, such as 7.0.8 or 6.9.11 (HelpHub). Sites with automatic background updates start updating on their own, but Wordfence recommends "checking your site rather than assuming the update completed" (vendor data).

My site is on an older WordPress version. Is it fixed?

HelpHub lists fixed releases for every version back to 4.7, down to 4.7.39, and says "WordPress 4.6 and earlier no longer receive security updates." WordPress.org's release post also says "The backports are in progress and will ship as they become ready," so confirm your version shows its fixed release.

What should I ask my web host or web person?

Ask which WordPress version is installed, whether automatic updates are on, and whether web access to wp-content/upgrade/ is blocked, which Patchstack recommends (vendor data). Asking them is our advice.

Do I need a security plugin to be safe?

Updating is the fix. Patchstack says "A PHP firewall cannot block it," and Wordfence says its own rule "does not replace installing the security update" (vendor data). We don't endorse any product.

Is this the same as the PHP security update?

No. This is a flaw in WordPress itself, fixed by updating WordPress. The PHP issue is in the server software WordPress runs on. We covered it in "PHP2Shell: What to Ask Your Web Host."

Has a CVE been assigned to the WordPress 7.1.4 flaw?

Yes. Wordfence published CVE-2026-119977 for it on Oct. 31, 2026. NVD, the federal vulnerability database, lists the record as "Undergoing Analysis" and hasn't scored it itself. WordPress.org's release post and HelpHub page don't list a CVE ID. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on Nov. 3, 2026.

Sources

1. WordPress.org News, "WordPress 7.1.4", Oct 28, 2026. WordPress.org release post. Accessed Nov. 3, 2026, 4:35 PM ET.
2. WordPress.org HelpHub, "Version 7.1.4", Oct 28, 2026. WordPress.org version page. Accessed Nov. 3, 2026, 4:35 PM ET.
3. Wordfence, "WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release", Oct 29, 2026. Wordfence blog post (text read via Wordfence feed). Accessed Nov. 3, 2026, 4:35 PM ET.
4. Patchstack, "WordPress 7.1.4 Security Release", Oct 28, 2026. Patchstack article. Accessed Nov. 3, 2026, 4:35 PM ET.
5. CISA, "CISA Catalog of Known Exploited Vulnerabilities", version 2026.11.03, released Nov 3, 2026. CISA Known Exploited Vulnerabilities catalog. Accessed Nov. 3, 2026, 4:35 PM ET.
6. CVE Program, "CVE-2026-119977", published Oct 31, 2026 by Wordfence; NVD status "Undergoing Analysis". CVE record. Accessed Nov. 3, 2026, 6:23 PM ET.
7. CISA, "CISA Adds One Known Exploited Vulnerability to Catalog", Nov 3, 2026. CISA alert. Accessed Nov. 3, 2026, 4:35 PM ET.