TL;DR: WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. The most serious is an unauthenticated race condition in the Core update process that can lead to remote code execution. Threat actors are already actively attempting to exploit it, so site owners should verify that WordPress has updated to 7.1.4 or the corresponding security release for their branch.
Wordfence Premium, Care, and Response customers received a new firewall rule on October 28, roughly three hours after the release. Wordfence Free users will receive the same rule after the standard 30-day delay,
