WordPress 7.1.4 security update: what small businesses must do
- What happenedWordPress fixed 22 security holes. One could let a stranger take over a website without a password.
- Who it affectsAny business whose website runs on WordPress and has not updated yet.
- What to doCheck today that your website has updated, or ask whoever looks after it to check for you.
In this article
If your business website runs on WordPress (the software many websites are built on), this update matters. WordPress released version 7.1.4 on 28 October 2026. It fixes 22 security problems, and one is serious. It could let a stranger make your website run their own instructions, without logging in. Within minutes of the security firm Wordfence switching on a block against this attack, it saw attackers hunting for it. It is worth ten minutes today.
What does the update fix?
The official release notes list 22 fixes. Most close gaps that let someone with a limited login to your website plant harmful code that runs in another person's web browser (experts call this cross-site scripting). Another stops a leak that let visitors see design changes before they were published.
The most important fix is described as "a race condition during core updates that could lead to remote code execution". It was reported by researcher Umut Bayram. In plain English, while WordPress updated itself, there was a brief moment when a stranger could sneak in and make your website run instructions of their choosing. That is the same as handing over the keys.
If your website is on an older version of WordPress, it may get its own fixed version instead, such as 7.0.8, 6.9.11 or 6.8.12. This goes back to version 4.7. Version 4.6 and older get no security fixes at all.
How does the problem work?
According to SecurityWeek and heise, when WordPress installs a big update to itself, it unpacks the new files into a folder with a name that is easy to guess (inside a folder called wp-content/upgrade). For a short time, anyone online can reach that folder, and it can contain the file WordPress uses to set a site up, called setup-config.php.
It is like the builders leaving the back door unlocked for a few seconds while they swap the lock. A stranger who tries the handle at exactly the right moment can tamper with the site's set-up, if they get in before WordPress tidies up. Heise reports that in lab tests the gap lasted only seconds. Wordfence rates it 8.1 out of 10 for seriousness.
The awkward twist is that automatic updates are normally a website's best protection. This time, the update itself was the weak spot. Version 7.1.4 fixes it by giving that folder a random name and adding extra safety checks.
Are attackers actually trying to use it?
They are trying. Wordfence says the first attempt caught by its new block arrived nine minutes after the block went live. In the first 21 hours it logged more than 18,500 attempts to reach that setup file. These are attempts, not break-ins. Wordfence has not reported any confirmed hacks.
Attackers cannot tell when a site will update, so they keep checking the same sites, hoping to catch one mid-update. Heise reports that two of the busiest attackers kept checking small groups of sites for about 14.5 hours.
GBHackers reports that Wordfence's paying customers got this block on 28 October. People using the free version are due to get it on 27 November. If you rely on a free security plugin (an add-on that protects your website), updating WordPress is your protection until then.
Is this a one-off?
No. Here are WordPress's security updates from the last six weeks:
- 7.1.1, 17 September11 security fixes.
- 7.1.2, 22 Septemberone fix for a flaw that let strangers reach files they should never see, which on some websites could let them run their own instructions. Heise notes it was also attacked within hours of release.
- 7.1.3, 6 Octoberseven security fixes, including one in the export tool that could let someone slip harmful commands into the site's database (where it stores its content).
- 7.1.4, 28 October22 security fixes.
That is 41 security fixes to the main WordPress software in six weeks, and the main software is usually the best looked-after part. Plugins (add-ons that give your website an extra feature, like a booking form) are where most trouble starts.
One example from the same month: a plugin called Bricksforge had a flaw rated 9.8 out of 10 for seriousness. It let anyone upload files and run their own instructions on a website without logging in. SecurityWeek reports that the security firm Patchstack first saw attackers trying to use it on 7 October. It is used on roughly 6,000 sites. Version 3.1.8.10 fixes it.
Does this affect my business website?
It does if your website runs on WordPress, whoever built it. Many owners do not know what their website is built on, especially if it was set up years ago. A quick test: add /wp-admin to the end of your web address. If a WordPress login page appears, your website runs on WordPress.
The risk is highest if:
- automatic updates are switched off, or your hosting company (the firm that keeps your website online) blocks them;
- your website is on a very old version of WordPress, especially 4.6 or older, which gets no fixes;
- your plugins or design theme have not been updated in months;
- nobody has the job of checking.
A hacked small business website rarely looks hacked. It is more often quietly used to send spam, host fake pages that trick people out of passwords, or send your visitors elsewhere. You may only find out when Google warns your customers, your hosting company suspends your account, or your emails start landing in spam folders.
What should I do now?
Work through this list today. If someone else looks after your website, send them this list and ask for a written reply.
- 1Check your versionLog in and go to Dashboard, then Updates. You want 7.1.4, or the fixed version for older sites.
- 2Update if neededTake a backup (a saved copy of the whole site) first, or ask whoever looks after your website to, then click Update Now. If it fails, do not keep retrying. Find out why.
- 3Check the update folderAsk whoever looks after your website to look inside the
wp-content/upgradefolder. It should be empty or nearly empty. Unexpected program files (PHP files) there are a warning sign. - 4Check who has full accessGo to Users and choose Administrator. If you see a name you do not recognise, remove it or ask about it.
- 5Tidy your pluginsDelete add-ons you do not use and update the rest. Plan to replace any its maker has not updated for a year or more.
- 6Ask for the recordsAsk your hosting company whether anyone tried to reach
setup-config.php, or program files inwp-content/upgrade, before you updated. Wordfence recommends this check for sites that were slow to update. - 7Keep automatic updates onThis problem is now fixed, and automatic updates are still the fastest way to get the next fix.
If any check finds something nobody can explain, assume someone has got in. Change every password, including your hosting and database passwords, and get the site cleaned before it hurts your place in Google or your customers' trust. Our £250 same-day Website Rescue exists for exactly this.
Should I move away from WordPress?
Not necessarily. Plenty of WordPress websites are well run and safe. But be honest about the work involved. A typical WordPress site has a database, a login page, a design theme and a pile of add-ons from different makers, each needing updates. That is a lot of moving parts for a plumber's or a solicitor's five-page website.
For many small businesses, a simpler website is safer. A hand-built website made of plain, ready-made pages, with no public login page, no database and no add-ons, removes the parts this month's attacks went after. That is how we build websites at Secure Web Studio, and it is worth thinking about at your next rebuild.
Whatever your site runs on, ask three questions. Do you know what software it uses? Do you know who updates it? Would you know if someone had tampered with it? If any answer is no, now is a good time to find out.
If your site is affected, call us on 01752 741969.
Sources
- Version 7.1.4 release notes
- WordPress 7.1.4 announcement
- WordPress releases archive
- Version 7.1.2 release notes
- Version 7.1.3 release notes
- Wordfence advisory on WordPress 7.1.4
- Fresh WordPress Vulnerability in Attackers' Crosshairs (SecurityWeek)
- WordPress update fixes code-injection flaw as exploit attempts emerge (heise)
- WordPress 7.1.4 Fixes 22 Security Vulnerabilities (GBHackers)
- Bricksforge WordPress Plugin Vulnerability Exploited in the Wild (SecurityWeek)