Weekly round-up: WordPress 7.1.4 is a security release, update it

WordPress shipped a security release on Wednesday. If you only do one thing from this round-up, make it that one.

WordPress 7.1.4: update it now

On 28 October WordPress.org released 7.1.4, tagged as a security release, and the announcement tells site owners to update immediately. It fixes a weakness in the upgrade process that could allow remote code execution during the upgrade window, plus a batch of stored cross-site scripting bugs in places like block markup, the Customizer, comment pagination and user logins. A denial-of-service issue and two information leaks, unpublished Customizer drafts and post notes, are in there too.

Sites with automatic background updates will install it on their own, so the first job is to check yours has. In the dashboard, go to Updates and see whether it says you have the latest version. If it does not, take a backup, click Update Now, then load your home page and send a test message through your contact form. That is about ten minutes. Keeping core, plugins and the layers underneath current is a routine part of WordPress development and care, and it is the best value security work there is, measured in minutes.

WordPress 7.2 is in beta

Beta 2 of WordPress 7.2 came out on 27 October, with the final release planned for 8 December. A beta is for people testing, not for live business sites, so there is nothing to do except know it is coming. I would leave a live site alone until the final release is out and your plugins say they support it.

What I published this week

Three pieces went up since the last round-up. Fixed price, day rate or monthly fee explains how web developers charge and what each model means for you. Web designer or web developer covers which one to hire for what. And Google Business Profile vs your website sets out what each does for a Hull business. If you missed last week, that round-up covered the critical PHP release.

One job for the weekend

Open your dashboard, check the WordPress version says 7.1.4, then go to Tools, Site Health, Info, Server and read the PHP version. Anything older than 8.2 is worth a call to your host, for the reasons in last week's PHP warning.

If you would rather someone else kept an eye on this, book a free 30 minute website surgery through the contact page and we can look at your site together.