WordPress 7.1.1 has been available since September 17, 2026. This maintenance release closes eleven security flaws found in core and the block editor, alongside seventeen core bug fixes and nineteen fixes in Gutenberg. The project’s security team calls it a priority release and recommends installing it right away rather than waiting for the next major version.
What 7.1.1 actually fixes
The patch covers a wide surface: stored script injection via wpautop(), weaknesses in the HTML API, exploitable theme headers, unauthorized theme installation, a plugin-activation bypass, authenticated path traversal on REST templates, abuse of the customize changeset through XML-RPC, arbitrary post overwriting, private post title disclosure, slug disclosure on drafts and pending posts, and unauthorized comment reparenting. Over a hundred contributors worked on the cycle, with representatives from major hosts including Automattic, Bluehost, GoDaddy, Pantheon and WP Engine.
The flaws that matter most
Two categories deserve particular attention on a production site. Authenticated path traversal on REST templates affects installations where several accounts hold editing rights, a common setup in agencies and teams. Abuse of the customize changeset via XML-RPC concerns sites that never disabled that legacy protocol even though they no longer use it.
| Component | Nature of the flaw | Exploitation condition |
|---|---|---|
| wpautop() / HTML API | Stored script injection | Unfiltered user content |
| Themes | Header exploit, unauthorized install | Admin access |
| Plugins | Activation bypass | Admin access |
| REST templates | Authenticated path traversal | Account with editing rights |
| XML-RPC | Customize changeset abuse | XML-RPC enabled |
| Comments | Unauthorized reparenting | Open comments section |
Eleven security flaws closed in a single maintenance cycle, including an authenticated path traversal on REST templates.
Updating without delay
The update is available from the dashboard, as a direct download from wordpress.org, or automatically if background updates are enabled. For a fleet of sites managed from the command line, wp-cli remains the fastest way to check and script it:
wp core check-update
wp core update
wp core update-db
wp core versionWhat comes after 7.1.1
This fix runs on a short cycle, separate from the usual roadmap. The next major version, WordPress 7.2, is still scheduled for December 2026. Until then, 7.1.1 is the baseline every publicly exposed site should be running, whether it’s a self-hosted installation or one managed by a third party.
What to take away
WordPress 7.1.1 fixes eleven security flaws and thirty-six bugs across core and the block editor. Updating without delay is recommended, especially for multi-account sites or ones that still expose XML-RPC. Version 7.2 remains on track for December 2026.
Maintenance releases like this one tend to go unnoticed next to the big feature launches, even though they’re the most urgent to act on. Across the site fleets tracked day to day, the priority is clear: handle 7.1.1 before anything else on this week’s list, XML-RPC disabled or not — Simon Janvier.
Further reading: the official announcement on wordpress.org.
