🚨 WordPress 7.1.4 released with fixes for 22 security vulnerabilities
WordPress has released version 7.1.4 and is urging administrators to update their websites immediately.
⠀
The security release addresses a race condition in the core upgrade process that could lead to remote code execution during the upgrade window.
It also fixes multiple stored cross-site scripting vulnerabilities affecting block markup, privacy data removal requests, the Interactivity API, Customizer selective refresh, Categories, playlists, images, comment pagination and specially crafted usernames.
⠀
Other resolved issues include:
• Disclosure of unpublished Customizer changes to unauthenticated visitors
• A stored denial-of-service issue in the Interactivity API
• Improper access to Notes attached to posts
• Several security-hardening weaknesses
• Replacement of bundled root certificates following the eMudhra revocation
⠀
Many of the vulnerabilities require Contributor, Author or Editor-level access, but the exact requirements vary by issue.
Security fixes have also been released for affected branches from WordPress 7.0 through 4.7. Versions 4.6 and earlier no longer receive security updates.
⠀
WordPress has not indicated that any of the vulnerabilities are being actively exploited.
Administrators can install the update through Dashboard > Updates. Sites with automatic background updates enabled should begin updating automatically.
WordPress NewsWordPress 7.1.4This security release features fixes for multiple issues. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.4 from WordPre…