What changed: WordPress 7.1.4 was released as a security update fixing multiple vulnerabilities, including a weakness in the upgrade process that could lead to remote code execution, several stored XSS issues, a stored denial of service issue in the Interactivity API, exposure of unpublished customizer changesets to unauthenticated users, and a notes access-control issue. Bundled root certificates were also updated due to the eMudhra revocation.
Who is affected
All sites running WordPress and the businesses operating them are affected; the source does not limit this to any specific sector or country.
What it means for your business
For businesses running WordPress, this means sites left unpatched remain exposed to stored XSS and unauthorized access vulnerabilities until updated to 7.1.4.
What to do
Log into your WordPress dashboard, go to Updates, and click Update Now to move to 7.1.4 immediately; sites with automatic background updates enabled will receive it automatically.
When it takes effect
The source does not state the release date; as a security release, immediate updates are recommended. The next major release, WordPress 7.2, is planned for December 8th.
