WordPress 7.1.4 Security Update and PHP2Shell a Week Later: What Website Owners Need to Do Now

October has been an exceptionally busy month for website security. After the WordPress security releases in September and the PHP2Shell vulnerability on 21 October, another WordPress security release has now arrived. This post summarises what changed and what website owners need to do.

WordPress 7.1.4: what was fixed?

WordPress 7.1.4 was released on 28 October and is a security release. The fixes were also backported to older versions down to 4.7 (for example 7.0.8, 6.9.11 and 6.8.12), but only the latest version is actively supported.

• Update process flaw: while an update was being installed, an attacker could under certain conditions run code on the server without having a user account. The flaw can only be used during the few seconds while an update is running, so it is considered hard to exploit in practice – but it is also the most serious fix.
• Several stored XSS flaws: in blocks, the Interactivity API, the Categories and comments pagination blocks, personal data erasure requests and elsewhere. Most of them require the attacker to have at least a Contributor or Author account on the site. Sites where several people add content are most at risk.
• Unpublished changes: logged-out visitors could see unpublished Customizer changes.
• Other fixes: a flaw in the Interactivity API that could make the browser hang, a notes permissions issue and updated root certificates.

Does WordPress 7.1.4 install itself?

If automatic background updates are enabled (they are on by default for minor releases), WordPress installs 7.1.4 by itself. Check it in the admin under Dashboard → Updates. If you use the separate Gutenberg plugin, update it too – some of the fixes come from the block editor.

PHP2Shell a week later: attacks are confirmed

Several important things have emerged about the critical PHP vulnerabilities fixed on 21 October (CVE-2026-109618 and CVE-2026-109619):

• Active attacks: on 26 October CISA added both flaws to its list of actively exploited vulnerabilities. On 24 October attackers succeeded in running code on security researchers’ honeypot servers.
• WordPress sites: on 28 October security company Wordfence said it was not yet aware of any WordPress site hacked through PHP2Shell – but attack attempts are seen constantly.
• A new related flaw: on 23 October PHP announced another flaw (CVE-2026-115560) that has not been fixed yet. It only affects a specific setup where an application changes how sessions are stored, and the temporary protection is the same as before: the setting session.upload_progress.enabled = 0. The fix will come in PHP’s next regular release.

If you have not yet checked whether your server’s PHP has been updated, do it now. You will find detailed instructions in our article Critical PHP vulnerability PHP2Shell.

Checklist

1. The WordPress version is 7.1.4 (or, on an older branch, that branch’s latest security release) – see Dashboard → Updates.
2. The server’s PHP version is at least 8.5.12, 8.4.27, 8.3.36 or 8.2.35 – see Tools → Site Health → Info → Server or ask your host.
3. Plugins and the theme are updated and unused plugins removed.
4. The user list contains no old or unknown accounts, especially with Contributor, Author, Editor or Administrator rights. The default role for new users is “Subscriber”.
5. You have a fresh backup stored off the server.

Why is all this happening at once?

Finding security flaws has become faster – partly thanks to artificial intelligence, which was also used to find PHP2Shell. This means the time between a fix being released and attacks starting keeps getting shorter. A website that is updated a couple of times a year inevitably falls behind. For security, someone needs to follow the announcements and install critical updates within days, not months.

Summary

WordPress 7.1.4 must be installed now and the server’s PHP must be updated – one does not replace the other. If you are not sure your website is protected on both fronts, get in touch – we will check it. For a long-term solution, see our website maintenance service, where security updates are installed quickly and tested.