انتشار نسخه ۷٫۱٫۴ وردپرس؛ آپدیت امنیتی فوری برای وب‌سایت‌ها

WordPress version 7.1.4 has been released to address a set of security vulnerabilities. This update fixes problems that could potentially lead to remote code execution, malicious code injection attacks, and unauthorized access to information.

The WordPress development team released version 7.1.4 of the content management system on October 28, 2026. Unlike major WordPress updates, the new version does not add new features to the administration or content editing sections, focusing instead on fixing identified security issues.

According to official WordPress website information, one of the important vulnerabilities resolved relates to the software's update process. Under specific conditions, this flaw could allow remote code execution during the update window. Security researcher Umut Bayram discovered and reported this problem.

Another portion of the fixes addresses stored XSS vulnerabilities. This type of attack occurs when malicious code is saved in website content and executed in users' browsers when viewed.

WordPress developers fixed several vulnerabilities of this nature in various sections, including content blocks, images, category lists, comment pagination, and the Interactivity API. Additionally, a problem in the personal data removal request process was identified that could lead to an XSS attack.

In version 7.1.4, another vulnerability in the Interactivity API was patched that allowed for denial-of-service disruptions. Issues related to the disclosure of unpublished customizer changes and the viewing of notes attached to posts by unauthorized users were also resolved.

Anthropic, the maker of Claude AI, played a role in identifying two vulnerabilities. One of the issues involved personal data removal requests, and the other involved manipulated usernames, both of which could enable stored XSS attacks.

WordPress also updated the digital root certificates bundled with the software due to the revocation of the eMudhra certificate.

The development team stresses that website administrators should upgrade WordPress to version 7.1.4 as soon as possible. For manual installation, administrators can access the Updates section in the WordPress dashboard. Websites supporting background automatic updates will receive the new version automatically.

Security fixes for this release are also being prepared for older eligible branches down to version 4.7. However, developers remind users that only the newest WordPress version is actively supported.

WordPress 7.1.4 is considered a short-term release, with the next major version, WordPress 7.2, currently scheduled for December 8, 2026. The third beta of WordPress 7.2 has also received the security fixes associated with the new update.

Version 7.1.4 is now available for download and installation from the official WordPress website.