WordPress 7.1.4 security update: how to update safely

Your dashboard shows a new notice: WordPress 7.1.4 is ready. It looks like every other update. This one is not. WordPress calls it a security release and asks site owners to update right away.

Here is what it fixes, who has to do something, and how to update without turning a quiet afternoon into a long one.

What was fixed in WordPress 7.1.4

The official release post lists the fixes. In plain words:

• A weakness in the update process itself. It can let someone run their own code on your site during the upgrade window. This is the serious one. Our data says someone with no account on your site could use it. Our data also marks it as used by attackers already, so treat it as urgent.
• Many "stored XSS" problems. That is harmful code saved on your site that then runs in the browser of whoever opens the page. The release post names the Interactivity API, the Categories block, the Playlist and image blocks, the comments pagination blocks, Customizer selective refresh, block markup, privacy data removal requests and user logins. In most of our catalog entries, the person who could do it is a Contributor, an Author or an Editor, not a stranger.
• A denial-of-service problem in the Interactivity API: someone with a Contributor account could make a page hard to load.
• Two information leaks. Unpublished Customizer changesets could be found by people who are not logged in. And privileged users without edit access to a post could read notes attached to it.
• Updated root certificates, because one certificate authority (eMudhra) had its certificate revoked.

Watchfox AI's catalog lists 20 entries for this release. You can see them on our WordPress core page. Other sites count the fixes differently, for example by grouping some together, so numbers vary. The release post is the one to trust for what changed.

I will not describe how the upgrade flaw works. You do not need that to act, and the details only help the wrong people.

Who needs to act

Everyone who runs WordPress 7.1.3 or older.

WordPress says sites that support automatic background updates will start updating on their own. If yours does, you may already be on 7.1.4. Many sites turn automatic updates off, or their host does, so do not assume. Check (next section).

The WordPress team also backported the fixes to older branches that still get security fixes, going back to 4.7. Those backports are rolling out as they are ready. Only the newest version is actively supported, so if you run something old, the real answer is to move up to the current release.

If your site lets visitors register, or you have Contributor, Author or Editor accounts you do not fully trust, do it today. The same goes for any site where the update screen has been sitting for days.

Check which version you run

1. Log in to your WordPress dashboard.
2. Go to Dashboard, then Updates.
3. At the top it says either "You have the latest version of WordPress" or that a new version is available.

You can also look at the bottom right corner of any dashboard page, which shows the version number. You want to see 7.1.4 or higher.

Back up first

An update can fail halfway, and a core update changes a lot of files. Take a backup you could restore:

1. Check whether your host offers a one-click backup or a snapshot. Many do.
2. If not, use a backup plugin and make sure it saves both the files and the database.
3. Download one copy off the server, so a server problem does not take your only backup with it.

Watchfox AI does not back up your site, so this step is yours.

If you can, do it on a quiet hour. A shop is better updated before the morning rush than during it.

Update: the dashboard way

1. Go to Dashboard, then Updates.
2. Click Update Now next to WordPress 7.1.4.
3. Stay on the page until it says the update is done. Do not close the tab or let the laptop sleep.
4. If WordPress shows a "database update required" screen, click the button to continue.

Update: the WP-CLI way

If you have SSH access and WP-CLI installed, this is the cleanest way, because it does not depend on a browser tab staying open. Run these from your WordPress folder, the one that holds wp-config.php:

`` wp core version wp core update wp core update-db wp core version ``

The first command shows your current version. The next two update the files and then the database. The last one should print 7.1.4.

If you are not sure what any of that means, use the dashboard way. It does the same job.

If the update breaks the site

Most updates finish without a problem. If yours does not, here are the three usual cases. This is also why you took the backup.

Stuck in maintenance mode

You see "Briefly unavailable for scheduled maintenance. Check back in a minute." and it does not go away. An interrupted update can leave a hidden file called .maintenance in your WordPress folder, as WP Remote explains.

1. Wait ten minutes first. The update may still be running.
2. Over FTP or your host's file manager, open the WordPress folder (the one with wp-config.php) and delete the .maintenance file. It is hidden, so turn on "show hidden files."
3. With WP-CLI, wp maintenance-mode deactivate does the same.
4. Deleting the file does not finish the update. Go to Dashboard, then Updates, and run it again.

A "critical error" message

The site says "There has been a critical error on this website." Usually a plugin or theme does not get along with the new version.

1. Check the email WordPress sent to the admin address. It often names the plugin.
2. Over FTP or the file manager, rename that plugin's folder inside wp-content/plugins. That switches it off.
3. Reload the site. If it works, look for an update to that plugin, or ask its maker.
4. If you cannot tell which plugin it is, restore your backup and ask your host for help.

File permission errors

WordPress says it could not copy files, or asks for FTP details. That means the server does not let WordPress write to its own folders.

1. Ask your host to fix the file ownership of your WordPress folder. This is the safe fix.
2. Do not set folders to 777 to make the message go away. That lets anyone on the server change your files.
3. When the host has fixed it, run the update again.

Confirm it worked

1. Open Dashboard, then Updates. It should say you have the latest version.
2. Check the version number at the bottom right of the dashboard. It should be 7.1.4 or higher.
3. Open your site in a private window. Look at the home page, a normal page and the page that earns your money: the contact form, the checkout or the booking page.
4. Log in as a normal user if your site has accounts.
5. Look at Plugins and Themes in the dashboard for any new warnings.

Watchfox AI does not update WordPress core. The same goes for the check: your own look is what tells you the site works.

Questions people ask

Do I have to update right now?

WordPress asks for it, and our data marks the upgrade flaw as used by attackers. So yes, today if you can. It does not need to ruin your day: a backup, then a few clicks.

My host updates WordPress for me. Do I still need to check?

Check once. Many hosts do it, but not all, and some wait. Open Dashboard, then Updates, and read the version.

Will the update break my plugins or theme?

Usually not. A security release changes very little compared with a big feature release. Still, plugins can misbehave, so test the parts of your site that matter after you update. The steps above tell you how.

Is it safe to wait for 7.2?

No. WordPress 7.2 is planned for December 8, per the release post. That is weeks away, and the flaws in 7.1.3 and older are public now.

Do this today

1. Check your version under Dashboard, then Updates.
2. Take a backup and keep a copy off the server.
3. Update to 7.1.4 from the dashboard or with WP-CLI.
4. Check your home page, forms and checkout in a private window.
5. Check that your plugins and themes are up to date too.

You do not have to watch security news to keep up. Watchfox AI sends plain-English security alerts for WordPress: every day our AI reads the security news and emails you when a plugin on your site needs fixing. It also warns about WordPress itself and your theme. Watchfox AI does not update WordPress core. For plugins and themes, its "Fix it now" button can update one after you click it, saving a copy of the old files first and putting them back if the site breaks. Every site gets a 14-day free trial with no card needed, and there is a free plan for one site. If you would rather just read, the free Monday list brings you the week's new WordPress security problems in plain words. You can sign up on any page of watchfox.site.

Written by the Watchfox AI team. How we check every warning.