Skip to content

The publication for web craftspeople Saturday, 19 September 2026

Security

WordPress 7.1.1 ships an urgent fix for eleven security flaws

WordPress 7.1.1 closes eleven security flaws in core and the block editor, including an authenticated path traversal in REST templates. The security team is urging every site to update immediately, ahead of the version 7.2 release due in December.

WordPress 7.1.1 has been available since September 17, 2026. This maintenance release closes eleven security flaws found in core and the block editor, alongside seventeen core bug fixes and nineteen fixes in Gutenberg. The project’s security team calls it a priority release and recommends installing it right away rather than waiting for the next major version.

What 7.1.1 actually fixes

The patch covers a wide surface: stored script injection via wpautop(), weaknesses in the HTML API, exploitable theme headers, unauthorized theme installation, a plugin-activation bypass, authenticated path traversal on REST templates, abuse of the customize changeset through XML-RPC, arbitrary post overwriting, private post title disclosure, slug disclosure on drafts and pending posts, and unauthorized comment reparenting. Over a hundred contributors worked on the cycle, with representatives from major hosts including Automattic, Bluehost, GoDaddy, Pantheon and WP Engine.

The flaws that matter most

Two categories deserve particular attention on a production site. Authenticated path traversal on REST templates affects installations where several accounts hold editing rights, a common setup in agencies and teams. Abuse of the customize changeset via XML-RPC concerns sites that never disabled that legacy protocol even though they no longer use it.

ComponentNature of the flawExploitation condition
wpautop() / HTML APIStored script injectionUnfiltered user content
ThemesHeader exploit, unauthorized installAdmin access
PluginsActivation bypassAdmin access
REST templatesAuthenticated path traversalAccount with editing rights
XML-RPCCustomize changeset abuseXML-RPC enabled
CommentsUnauthorized reparentingOpen comments section

Eleven security flaws closed in a single maintenance cycle, including an authenticated path traversal on REST templates.

Updating without delay

The update is available from the dashboard, as a direct download from wordpress.org, or automatically if background updates are enabled. For a fleet of sites managed from the command line, wp-cli remains the fastest way to check and script it:

wp core check-update
wp core update
wp core update-db
wp core version
On a hardened baseline, XML-RPC is typically disabled by default, which already shrinks the exposure to one of the flaws this release fixes.

What comes after 7.1.1

This fix runs on a short cycle, separate from the usual roadmap. The next major version, WordPress 7.2, is still scheduled for December 2026. Until then, 7.1.1 is the baseline every publicly exposed site should be running, whether it’s a self-hosted installation or one managed by a third party.

What to take away

WordPress 7.1.1 fixes eleven security flaws and thirty-six bugs across core and the block editor. Updating without delay is recommended, especially for multi-account sites or ones that still expose XML-RPC. Version 7.2 remains on track for December 2026.

Maintenance releases like this one tend to go unnoticed next to the big feature launches, even though they’re the most urgent to act on. Across the site fleets tracked day to day, the priority is clear: handle 7.1.1 before anything else on this week’s list, XML-RPC disabled or not — Simon Janvier.

Further reading: the official announcement on wordpress.org.

Read next