WordPress 7.1.4 fixes an RCE in its own upgrade process
The security release patches thirteen issues in core, including a code-execution weakness during updates and several stored XSS bugs, two of them found by Anthropic.
WordPress shipped 7.1.4 today, a security release patching thirteen issues in core, and is telling site owners to update immediately.
The headline bug is a weakness in WordPress’s own upgrade process that can lead to remote code execution during the update window itself. The rest of the list is mostly stored XSS: in block markup, the Interactivity API (found independently by seven researchers), Customizer selective refresh, the Categories block, the Playlist and Image blocks, comment pagination blocks, and in crafted usernames at login, the last two found by Anthropic’s security team. There’s also an unauthenticated information-disclosure bug in Customizer changesets, a privilege-escalation flaw in the Notes feature, and a denial-of-service issue in the Interactivity API. The release notes don’t report any of this as exploited in the wild. WordPress also updated its bundled root certificates to drop the revoked eMudhra ones. Sites with background updates enabled get 7.1.4 automatically.
Why it matters: these are core bugs, so every WordPress install is affected regardless of which plugins are running. The upgrade-process RCE is the one to treat as urgent, since it means the update mechanism itself was a weak point until now.
The caveat: no CVE numbers are attached yet, so you can’t check patch status against a CVE ID. Check the version number in your dashboard instead; anything on 7.1.3 or earlier needs this update.