The latest security release for WordPress, 7.1.4, is available on Pantheon.
Action required
Because this is a security update, we recommend all users upgrade to WordPress 7.1.4 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.
Pantheon has deployed platform-wide mitigations against external abuse of some of the vulnerabilities fixed in this release, and is actively monitoring those rules. However, customers need to update their sites as soon as possible.
Highlights
This release resolves 13 security issues:
- A remote code execution weakness in the upgrade process.
- Stored XSS via specially crafted block markup.
- Stored XSS in privacy data removal requests.
- Multiple stored XSS issues in the Interactivity API.
- A stored denial of service in the Interactivity API.
- Stored XSS in Customizer selective refresh.
- Stored XSS in the Categories block.
- Stored XSS in user login fields.
- Unauthenticated disclosure of unpublished Customizer changesets.
- Stored XSS in the Playlist and Image blocks.
- Stored XSS in the Comments pagination blocks.
- Notes readable by unauthorized privileged users, allowing privilege escalation.
This release also updates the bundled certificates to account for the revocation of an eMudhra root certificate.
For full details, see the WordPress 7.1.4 release announcement.
