WordPress has released version 7.1.4, a security update that fixes 22 vulnerabilities. The most serious one affects the update process itself and, under certain conditions, could allow code to run on the server. If your online store or corporate website runs on WordPress or WooCommerce, it needs to be applied this week. It is also a good moment to review something more important than the patch: who maintains your website, and how.
What exactly it fixes
The update was released on 28 October and has also been applied to every version that still receives security patches, back to 4.7. In other words, some of these flaws had been open for years on a huge number of websites. They fall into three groups:
- The update process. This is the most serious flaw: during the short window in which the site is updating, an attacker could, under certain conditions, run code on the server and take it over. The moment you catch up is also a moment of exposure if it is not done in a controlled way.
- Malicious code stored in content. Technically known as stored XSS, it shows up in many places: editor blocks (categories, images, playlists, comment pagination), the theme Customizer, personal data erasure requests and even usernames. The pattern is always the same: someone with an account, often at contributor level, leaves code that runs when an administrator opens that page. That is enough to steal the administrator’s session and act on their behalf.
- Information visible when it should not be. Unpublished design changes that any visitor could see, and internal notes readable by users without permission on that content. In practice: the redesign of a campaign or a promotion that has not been announced yet.
The release also renews the root certificates WordPress uses to connect securely to other services, following the revocation of a certificate authority. Sites with automatic updates switched on will get it on their own, but many companies switch them off, precisely for fear of something breaking.
A telling detail
Two of the flaws were reported by an artificial intelligence lab. This is not a curiosity: AI is speeding up the discovery of vulnerabilities, which means more alerts, more often. Updating “when there is time”, or once a year, is no longer a reasonable option for a website that sells.
Why it matters to your business
Sales. A compromised store usually ends up offline while it is cleaned, or flagged as dangerous by browsers and search engines. Every day without sales has a direct cost and a longer-lasting one: customer trust.
Data and legal obligations. A breach on a website holding customer data means managing the incident, reporting it where required and giving explanations. The internal effort and the reputational damage far outweigh the cost of keeping the platform up to date.
Forgotten access. The fact that many of these flaws require an account is only half good news. Many mid-sized companies still have active users from former agencies, occasional freelancers or employees who have left. Each of those accounts is a door.
What to check this week
- That the site is on 7.1.4 (or the patched version of its branch) and that, after updating, the catalogue, cart, payment and order emails all work.
- Who has an account. Remove the ones you no longer need and require two-factor authentication for administrators.
- Who is responsible. If the answer is “nobody in particular” or “the agency that built it”, the problem is not this update but the next one.
How we approach it at TRILOGI
WordPress core is rarely what fails. On the websites we review, the risk lies around it: plugins nobody has updated in years, modified themes that cannot be updated without breaking the design, WooCommerce extensions from vendors that no longer exist, and administrator accounts shared by half the company.
That is why, when a company asks us for help after an alert like this one, we do not stop at the patch. We take an inventory of everything installed on the site and its maintenance status, flag which pieces are a risk or no longer needed, and leave an update schedule with clear owners. From there, our Customer Care team can take over maintenance with agreed response times, so the next alert is routine rather than an emergency.
Every Tuesday, the 5 news stories that matter: subscribe to the newsletter.
