WordPress Unveils Version 7.1.4 to Mitigate Critical Vulnerabilities
WordPress has officially launched version 7.1.4, a crucial security update aimed at addressing a total of 22 vulnerabilities.
These flaws encompass serious concerns such as remote code execution, stored cross-site scripting, information disclosure, and weaknesses in authorization protocols.
This vital update was released on October 28, 2026, and it is strongly advised that users upgrade their installations without delay.
The improvements pertain to core functionalities, which include content blocks, administrative interfaces, the Customizer, and the Interactivity API.
The official security notice reveals a race condition during core updates, which could potentially lead to remote code execution.
This particular vulnerability, reported by researcher Umut Bayram, poses a risk during the execution phase of the upgrade process.
Notably, the documentation lacks specifics regarding exploitation conditions or whether this flaw has been actively targeted by malicious actors.
Stored XSS Vulnerabilities in Core Components
A series of patches have been introduced to counter stored cross-site scripting vulnerabilities that could be exploited by accounts at the Contributor level or higher.
The vulnerabilities include specially fashioned whitespace in block delimiters, unsafe JavaScript URLs embedded in Interactivity API bindings, as well as nefarious event-handler bindings.
Other weaknesses encompass prototype pollution within Interactivity API context namespaces, which may result in either stored XSS or denial-of-service conditions.
A specific vulnerability affecting author-level access within the Interactivity Router raises concerns about how uploaded text files are managed.
Moreover, updates address various issues including selective refresh in the Customizer, format-string injection vulnerabilities within the Categories block, and labeling irregularities in the Comments Pagination and Post Navigation Link blocks.
Furthermore, WordPress has bolstered security measures by hardening the unsafe handling of replacements within the Image and Playlist blocks, thereby preventing post content from overshadowing Script Module data through matched element identifiers.
Reports from Anthropic disclose an editor-level stored XSS vulnerability associated with personal data erasure requests, in addition to a separate concern regarding username escaping that impacts Network Users screens in multisite configurations.
These findings come in the wake of earlier documented WordPress stored XSS vulnerabilities; however, the latest issues involve different components and methods of exploitation.
The update also restricts unauthenticated visitors from accessing unpublished changes in the Customizer.
In another noted correction, custom roles with comment-moderation permissions are prevented from reading, editing, or deleting notes linked to posts they are not permitted to edit.
Additionally, the update has included root certificates in light of the eMudhra revocation. It is worth mentioning that individual CVE identifiers or severity ratings have not yet been assigned in the documentation.
The upgrade-window RCE issue should not be mistaken for the previously addressed WordPress path-traversal vulnerability.
The earlier concern revolved around page-template resolution under certain server and theme configurations, as opposed to the race condition affecting core updates.
Administrators may install this release by navigating to Dashboard → Updates → Update Now. Sites with automatic background updates should receive this update seamlessly; however, it is prudent for administrators to confirm its completion.
WordPress has acknowledged legacy releases patched down to version 4.7.39, while reiterating that only the most recent version continues to receive active support. Older branches will receive varied subsets of fixes based on their vulnerability exposure.
The recent versions, 7.0.8 and 6.9.11, effectively address all 22 vulnerabilities, while versions 6.8.12 and 6.7.11 rectify the 20 vulnerabilities affecting those branches.
Administrators are urged to implement the relevant updates promptly, rather than postponing resolution until the anticipated WordPress 7.2, set to launch on December 8, 2026.
Source link: Gbhackers.com.
