Site owners running WordPress have a patching job this week. Version 7.1.4 closes 22 vulnerabilities, Search Engine Journal reported on Oct. 28. The most serious is a race condition in the core update routine that could allow remote code execution while an upgrade runs. Researcher Umut Bayram found it. WordPress has not said what access or server setup an attacker would need, or whether a login is required.
The rest of the batch touches the Customizer, blocks, the Interactivity API, and admin screens, including several stored cross-site scripting bugs and some information disclosure. Many need Contributor-level access or higher. Some flaws date to version 4.7, so older installs are exposed as well.
The SEO stake is practical. A compromised site is where spam injection, cloaked links, and malicious redirects begin, and those can bring security warnings and ranking losses. Update to 7.1.4 now, and confirm that auto-updates actually applied on every client install.
Search Engine Journal, Roger Montti, Oct. 28, 2026.
