WordPress 7.1.4 Update: Test Your Calls, Forms and Quotes After the Patch

A website can be up and still not do its job. The home page loads, but the call button dials an old number. The quote form says “thanks” and the email never arrives. Nothing looks broken, so nobody notices until the phone goes quiet.

That is what I watch for after a WordPress update, and this week there is one you should not put off. WordPress 7.1.4 came out on October 28, 2026. It fixes CVE-2026-119977, a flaw in how WordPress runs its own updates, plus some smaller security fixes. On November 3, CISA added the flaw to its list of vulnerabilities that attackers are already using, and set November 6 as the deadline for the federal agencies it covers.

That date does not bind a private business. I would still treat it as yours. Here is how I install this update on a small business site, and the ten checks I run afterwards to make sure calls and quote requests still come through.

Install the update without losing leads

• Back up the files and the database. You need both. The files hold your theme and plugins; the database holds your pages, settings and most contact-form setups. Keep the backup somewhere the update can't overwrite.
• Try it on a copy first if you have one. A staging copy lets you catch a plugin conflict before customers do. Many staging copies don't send email, so the email test still has to happen on the live site.
• Update when someone can watch the phone and inbox. Don't bundle it with a redesign or a big plugin cleanup. If something breaks, you want to know which change did it.
• Test the public site, not the dashboard. The admin screen can say “Updated” while the form visitors use is broken. Run the checks below from a normal browser and a real phone.

The 10-point test

1. Every call button dials the right number. Tap each one, on every service and location page, and read the number in the phone's dialer before you call. Old pages keep old numbers.
2. Every form sends. Fill in each form with a message your staff will recognize and make sure you reach the confirmation screen. Service pages and booking pages often use a different form than the contact page.
3. The email lands in the right inbox. A saved entry is not a delivered lead. Open the inbox of whoever answers quotes and check the message arrived with the customer's details. If it didn't, treat it as a failure, not a slow email.
4. The spam filter lets a real person through. Check the spam and quarantine folders too. If a normal inquiry gets caught, fix that rule rather than turning off the filter.
5. Call taps and form sends still get counted. Watch your analytics real-time report while you test. Each tap and each send should show up once, not twice and not zero times.
6. Booking links open the right calendar. Test them signed out, the way a customer sees them, and cancel any test appointment afterwards.
7. The thank-you page works. After the form sends, it should land on a real page that tells the customer what happens next.
8. The site still works on a phone. Use cellular data, not the office Wi-Fi. Check that buttons respond and form fields open the right keyboard.
9. The cache shows the new site. Clear the page cache and any CDN cache, then load the site in a private window. Old cached pages can bring back old phone numbers and broken scripts.
10. WordPress says 7.1.4. Confirm the version in the dashboard and read any warnings from your security plugin instead of dismissing them.

Then make sure nobody got in first

CISA asks the agencies it covers to do forensic triage on this one, because a site that was broken into can look perfectly normal from the outside. A small business doesn't need a full investigation, but a few basic checks are worth ten minutes:

• Look at the WordPress user list for admin accounts you don't recognize.
• Look for pages, links or files you didn't add.
• Run your security plugin's file scan if it has one.

If you find something, stop and get help before you delete it; removing one file doesn't tell you how it got there. Our sister company covers that side in what to check for a break-in after the WordPress 7.1.4 patch.

The checklist

When to get help

If you can log in to WordPress and your form plugin, you can do all of this yourself in under an hour. Bring someone in when:

• Nobody knows who has the WordPress login, or what version you're on.
• The update fails, or the site looks wrong afterwards. Our page on what to do when a WordPress update breaks your site walks through it.
• A form sends but the email never shows up, and you can't tell why.
• You found an admin account or file you didn't add.

On the sites we look after, updates, backups and a test of the call and quote paths are part of website care, so you don't have to remember to do it.

Questions

Sources

• WordPress.org: WordPress 7.1.4 Security Release (Oct. 28, 2026)
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (Nov. 3, 2026)
• CISA: Known Exploited Vulnerabilities Catalog

Drafted with AI assistance and checked against the sources above on November 6, 2026.