WordPress 7.1.4 fixed 22 security flaws: what small business owners should check

On October 28, 2026, WordPress released version 7.1.4, a security release. The official WordPress.org release notes say it fixes 22 vulnerabilities and that "it is recommended that you update your sites immediately."

Most of the fixes are for stored cross-site scripting, which means someone with a login to your site, such as a contributor or editor account, could plant harmful code that runs in other visitors' browsers. There's also an information leak involving unpublished Customizer changes, a permissions issue with comment moderation, and a denial-of-service issue, which is a way to knock a site offline.

The one getting the most attention is a race condition in the core update process. A race condition is a bug that only shows up when two things happen at almost the same moment. In this case, Search Engine Journal reports it could allow remote code execution, meaning an attacker could run their own code on your server, during the short window while WordPress is updating itself. The researcher credited with finding it is Umut Bayram.

Security releases come out regularly, and most of the time they're routine. This one moved faster than usual. Cyber Security News reported on October 31 that Wordfence, a WordPress security company, blocked 60,471 attempts targeting the flaw over 24 hours. The article is careful to say those are attack attempts, not confirmed break-ins, but it shows people went looking for unpatched sites within days.

A few other details matter for small business owners:

• It's in WordPress itself, not a plugin. That means it can affect a site even if every plugin is up to date.
• Older versions got fixes too. Patches were released for older branches, including 7.0.8 and 6.9.11, with backports as far as 4.7. WordPress 4.6 and earlier no longer receive security updates at all.
• Some firewall protection is delayed. According to the same report, Wordfence's free users are scheduled to get the related firewall rule on November 27, about a month after paid customers. The advice is to patch now rather than wait.

If your business website runs on WordPress, here's what I'd do today. Most of this takes a few minutes.

1. Check your version. Log in and go to Dashboard, then Updates. You want 7.1.4, or the matching security release for your branch. If you see an update waiting, run it.
2. Confirm the update actually finished. Reload the Updates page afterward and make sure the new version shows.
3. Update your plugins and theme. They aren't the cause this time, but outdated plugins are a common way into a site, so clear the list while you're there.
4. Look at your user accounts. Several of these fixes involve people who can log in. Remove accounts for former employees, past contractors and anyone who no longer needs access.
5. Ask who handles updates. If a web person or hosting company maintains your site, send a quick note asking whether 7.1.4 is installed. If nobody's sure, that's your answer.
6. Make sure you have a recent backup. Before any big update, a backup you can restore is the best insurance there is.

I want to be fair here. WordPress runs a huge part of the web, the team behind it found and fixed these problems, and they shipped patches for versions going back years. That's responsible. For a long time, a WordPress theme and a few plugins made a lot of sense for a small business: inexpensive, familiar and quick to set up.

The trade-off is upkeep. Every theme, plugin and core release is software that someone has to keep current, and a site with a login system, a database and a dozen plugins has more doors to watch. Many small business sites were built once and then left alone, which is exactly the kind of site attackers hope to find.

That's one reason I build the way I do. My sites are hand-coded, with no theme or page-builder plugins, and they deploy to a global edge hosting network with automatic HTTPS. There's far less moving software sitting on a server waiting for updates. It's not magic, and no website is risk-free, but fewer moving parts means fewer things to patch. You can read more in custom code vs. website builders and website care and hosting.

Your website is often the first place a customer meets you. If it gets hacked, it can show spam, send visitors somewhere else or get flagged by browsers, and that costs trust you worked hard to build. So here's my plain advice:

• Know what your site runs on and who is responsible for updating it. Write that name down.
• Treat security updates like a smoke detector battery. Small, boring and important. Don't let them sit.
• Keep only what you use. Every unused plugin and old login is one more thing to watch.
• If upkeep keeps falling through the cracks, it may be time for a site that needs less of it.

If you run a business here in Surprise or anywhere in the West Valley and you're not sure whether your site is current, call or text me at 480-550-2871. I'm happy to take a no-obligation look and tell you what I see. And if you're thinking about a rebuild, start with web design in Surprise, AZ.