WordPress 7.1.4: update your site and confirm the version

If your business site runs on WordPress, version 7.1.4 is the number to check today. WordPress.org released it on October 28, 2026, as a security release and recommends updating your sites immediately. It fixes multiple issues, including a weakness in the upgrade process that can lead to remote code execution during the upgrade window.

Remote code execution means someone else could run their own code on your site. A security firm has reported tens of thousands of blocked attacks aimed at this flaw, so the news can feel urgent. The good part is that the check takes a few minutes, from the dashboard you already log in to.

Open Dashboard, then Updates, and read the version number. If it says 7.1.4, you are current. If it shows anything lower, back up and update. That is the whole first move.

What did WordPress.org release on October 28, and who needs to update?

WordPress.org published the 7.1.4 announcement on October 28, 2026. It describes the release as a security release with fixes for multiple issues and says it is recommended that you update your sites immediately. Any site showing a version below 7.1.4 is the site to update.

The announcement lists the upgrade-process weakness that can lead to remote code execution during the upgrade window, credited to Umut Bayram. It also lists multiple stored cross-site scripting issues, a stored denial-of-service issue, information exposure involving unpublished customizer changesets, notes access, and a bundled root-certificate update.

The backports matter if your site sits on an older release line. WordPress.org says eligible branches currently reach back to WordPress 4.7. On those sites, the Updates screen offers the newest security release for your line, and that is the one to take.

How do I check my WordPress version and update to 7.1.4?

Log in to your WordPress administration area, open Dashboard, then open Updates. The page shows the installed WordPress version and whether a newer release is waiting. WordPress.org's update instructions point to the same place and tell you to click Update Now.

Before you click, confirm you have a current backup. WordPress.org's backup documentation covers the database and files, and your host may keep its own copies too. A backup you have never opened is a guess, so ask your host how to restore one if you are unsure.

If you handled the WordPress 7.1.2 security update earlier, the steps are the same. Only the version number you are looking for has changed.

Caches can make an updated site look unchanged. If Updates still shows the old number, clear your caching plugin, your host's server cache, and any CDN, then reload the screen.

Once the version reads 7.1.4, test the parts of the site that bring in business. A security update touches core files, and a plugin, theme or custom code can react to it in ways that only show up when someone uses the feature.

Write down what you tested and what happened. If something broke, that note tells your host or developer exactly where to look.

Did my site already update automatically, and what if the update fails?

WordPress.org says sites with automatic background updates update automatically. Its documentation adds that WordPress 3.7 and newer can apply minor and security updates in the background, depending on the site's configuration and its ability to perform one-click updates.

So, treat the setting as a likely helper, not as proof. The version number in Dashboard, then Updates, is the proof. If it reads 7.1.4, the fix is in place. If it reads lower, take the manual update steps.

If the update fails, stop and make sure the current backup is in hand. Then contact your host or the person who administers the site. WordPress.org documents filesystem-permission troubleshooting for failed updates, and fixing ownership or permissions is usually a hosting-level job. A failed update is a reason to ask for help the same day, because the site stays on the old version until it is resolved.

For recurring updates, backups and testing, our website maintenance work covers that routine so a release like this one is handled before you read about it.

What do the 62,969 blocked attack attempts mean for my site?

Wordfence reported blocking 62,969 attacks targeting this vulnerability in the 24 hours before its October 30, 2026 report. That figure is Wordfence's count from its own network, and it belongs to Wordfence alone.

A blocked attack is an attempt that was stopped, so the number measures activity, not damage. It also is not a prediction for your site. Wordfence described the activity as repeated polling of paths such as `setup-config.php` under the temporary upgrade directory.

Wordfence described the exploit as needing a full-package core update, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to finish before cleanup. That is a narrow set of conditions, which is one more reason to move through the update without leaving it half done.

An old version is a reason to update, not proof that anyone got in. Your first ten minutes belong to the version check and the update, not to working out a personal probability from a global number.

What are the signs someone got into a WordPress site?

Updating closes the door that this flaw uses. It leaves anything that was already inside where it is. So, after the update, look for concrete signs rather than assuming either way.

These are the signs worth acting on:

• Unfamiliar administrator accounts: Users you or your team did not create.
• Unexpected plugins or themes: Anything you did not install.
• Unfamiliar PHP files: Especially in upload or upgrade folders.
• Suspicious requests involving wp-content/upgrade: Visible in your host's access logs.
• Behavior you cannot explain: Redirects, new pages, or alerts from your host.

If you see any of them, preserve logs and backups before you delete anything, because deleted files cannot be inspected. Restrict access where practical, then have your host or a qualified incident-response provider inspect the site. Change credentials and end active sessions once the site is contained.

Our guide to the first 24 hours after a website is hacked walks through that order in more detail. Core is only one piece, so also check your WordPress plugins for urgent security updates, since a core update leaves plugins and themes as they were.

When can I handle this myself, and when should I bring in help?

If you can log in, you can check the version and update in minutes. An old version on its own is a reason to update, and a paid security service is not required just because the number was low.

Bring in help in these situations:

• You cannot reach the dashboard: Or the update fails.
• The site runs custom code or revenue-critical transactions: A bad update costs real money.
• Your backups are not dependable: Or you have never tested a restore.
• Several installations need the same work: One at a time stops being practical.
• You see signs of compromise: Any of the signs listed earlier.

Match the help to the problem. A website security audit fits suspicious files, accounts or logs. Hosting fits permissions, caching and recovery. Quality assurance fits forms, checkout and bookings after an update. Ask any provider exactly what they will inspect, fix and test, since an update or an audit on its own does not remove malware.

Frequently Asked Questions About WordPress 7.1.4

What is WordPress 7.1.4?

A security release that WordPress.org published on October 28, 2026. It recommends updating immediately. It fixes multiple issues, including an upgrade-process weakness that can lead to remote code execution during the upgrade window.

How do I check my WordPress version?

Log in, open Dashboard, then Updates. The page shows the installed version and whether a newer release is available. If it is below 7.1.4, back up and click Update Now.

Did my site update automatically?

It may have. WordPress.org says sites with automatic background updates update automatically, but the setting alone is not proof. Confirm that Dashboard, then Updates, shows 7.1.4.

Does the attack number mean my site was hacked?

No. Wordfence reported blocking 62,969 attacks in the 24 hours before its October 30, 2026 report. Blocked attempts are not confirmed compromises. Look for concrete signs such as unfamiliar admin accounts, plugins or PHP files.

What if the update fails?

Make sure you have a current backup, then contact your host or WordPress administrator. WordPress.org documents filesystem-permission troubleshooting for failed updates.

Does updating remove malware?

Updating closes the weakness; it leaves existing files and accounts in place. If you see signs of compromise, preserve logs and backups and have your host or a qualified incident-response provider inspect the site.

Wrapping Up

WordPress 7.1.4 is a security release dated October 28, 2026, and WordPress.org recommends updating immediately. The check is short: Dashboard, then Updates, then the version number. Back up, update, confirm 7.1.4, clear caches if needed, and test your homepage, contact form, lead notifications, checkout, booking tool and login.

Wordfence's 62,969 blocked attacks tell you the weakness is being tried, not that your site was breached. Concrete signs, such as unfamiliar admins, plugins or PHP files, are what call for a deeper look.

When you finish, you will know your installed version, your backup status, which business functions you tested, and when to ask for help. If you want a second set of eyes, Web Leveling can run a website security audit for suspicious files, accounts or logs, or take over the update routine. We work with small and medium businesses across the country and overseas. Contact us about your WordPress site and we will tell you whether it needs a fix or just a version check.

Terms