Prepared by the Nadali editorial team using AI
WordPress 7.1.4 was released on October 28, 2026, with security fixes. The WordPress team recommends updating sites immediately. For a business owner, the useful outcome is not the announcement itself but confirmation that the fixes are installed on the production website.
Who should pay attention
Shops, hotels, restaurants and other businesses with WordPress websites—especially those receiving orders, bookings or enquiries through them. If a contractor manages the site, send them the release notice rather than trying to identify the version from the page’s appearance.
What changed
According to the version documentation, the fixes include a weakness in the core update process that could lead to remote code execution during the update window. The release also addresses several cross-site scripting (XSS) issues and a permissions problem: custom roles allowed to moderate comments could read, edit and delete notes attached to posts they were not allowed to edit.
This describes attack possibilities that have been fixed, not evidence that your website has been breached. Nadali has not inspected individual installations or conducted its own vulnerability tests.
What to ask your administrator to do
The official updating guide recommends a backup before updating; the standard route is Dashboard → Updates → Update Now. For owners who do not administer their own sites, our editorial recommendation is to agree on a short plan with the person responsible:
- Record the current core version and the applicable fix.
- Confirm a backup and the ability to restore it.
- Apply the official update and report the version actually installed afterward.
- Check the website’s key workflows: an enquiry form, booking or checkout, depending on what it provides.
The last step is our practical advice, not a WordPress test result. Opening the homepage alone is not enough to check the entire customer journey.
Availability and limitations
WordPress says the process will start automatically on sites supporting automatic background updates. That does not confirm that your particular website has already updated: ask someone to verify the outcome.
The documentation also lists patched older branches, but only the latest version is actively supported. For an older installation, the administrator needs to check the applicable release rather than assume that any old version is protected. Updating core does not replace separate checks of plugins, themes and the server environment.
Bottom line: obtain three confirmations from whoever manages the site—the installed version, an available backup and checked customer workflows. Do not delay contacting the administrator solely because automatic updates exist.
Related: what to ask your hosting provider about the separate PHP fixes.
Sources checked on October 29, 2026; release date: October 28. Cover: reused original Nadali AI-generated illustration, not an incident photograph or a test result.
