What was fixed
The documentation page for 7.1.4 lists the 22 vulnerabilities in 17 entries, plus renewed root certificates. The one that reaches furthest sits in the update itself: a race condition during a core update can lead to someone else's code running on the server. The WordPress release post refers to the upgrade window. Neither text says who could exploit it or under which conditions.
Without logging in, visitors could get at unpublished changes from the Customizer, the tool for adjusting a site's design. A draft of something that was not meant to be online yet could therefore be readable.
Ten entries require a logged-in account with at least Contributor, Author or Editor rights. Most of them concern stored XSS, meaning malicious code that gets saved and later runs in other users' browsers. Where only a small, trusted group has accounts, we consider this group less urgent. The update brings all the fixes together anyway.
Who is affected
WordPress carried the fixes into every branch back to 4.7, on the same day as 7.1.4. If your version is below the number for your branch, you are missing fixes:
| Branch | Release with the fixes |
|---|---|
| 7.1 | 7.1.4 |
| 7.0 | 7.0.8 |
| 6.9 | 6.9.11 |
| 6.8 | 6.8.12 |
| 6.7 | 6.7.11 |
The documentation page gives the numbers for the branches below those. Branches 7.0 and 6.9 are affected by all 22 vulnerabilities, older branches by fewer, 4.7 by two. Versions up to 4.6 no longer receive security fixes, and WordPress says only the most recent version is actively supported.
What to do
In the admin area you find the number under Dashboard → Updates, where “Update Now” also starts the update. Our September note explains how to see your version from the outside without logging in.
With automatic background updates the update starts by itself. Check once anyway that the number from the table has arrived. Plugins and themes have their own updates, listed in the same menu.
If an agency looks after your site, a short email with the number from the table is enough. WordPress plans the major release 7.2 for 8 December, and you do not need to wait for it to get these fixes.