WordPress developers released version 7.1.1 on September 17, 2026, featuring 11 security fixes along with dozens of bug fixes in WordPress core and the block editor. As this is a security and maintenance release, website administrators are strongly advised to update as soon as possible.
WordPress 7.1.1 fixes 17 bugs in WordPress Core and 21 bugs in the block editor. However, the most critical part of the update is addressing the 11 security vulnerabilities. These include XSS vulnerabilities, authorization check issues, information disclosure flaws, and bugs that allowed users with specific roles to modify content they normally shouldn’t have access to.
This marks the first major maintenance release since August’s release of WordPress 7.1 “Mary Lou”, which introduced features like responsive styles, a new media editor, an enhanced Notes feature, and new Playlist and Tabs blocks to the CMS.
An XSS vulnerability could be exploited even by unauthenticated users
One of the vulnerabilities fixed in WordPress 7.1.1 involves the wpautop() function and enabled a stored XSS attack—the injection of malicious scripts.
Crucially, attackers did not need to be logged into WordPress to exploit this bug. However, successful exploitation still depended on a comment being approved. The vulnerability was reported by Rafie Muhammad from Awesome Motive.
A second stored XSS flaw affected certain WordPress themes that support custom header images.
A fix was also made to the WordPress HTML API, where the set_modifiable_text() function allowed breaking out of an HTML comment using specially crafted closing sequences.
A specially crafted URL could trigger theme installation
One of the most interesting security flaws allowed an uninstalled theme hosted on WordPress.org to be automatically installed and previewed on a site via a specially crafted URL.
The issue was reported by Paulos Yibelo and pwn.ai.
Meanwhile, for WordPress Multisite, a permission bug was resolved that allowed a site administrator to activate a Network-only plugin intended for the entire network.
Path Traversal vulnerability fixed in REST API
WordPress 7.1.1 also addresses an authenticated Path Traversal vulnerability in the WP REST Templates Controller. The issue was reported by Anthropic.
Anthropic discovered another security issue where users with at least Contributor-level privileges could overwrite an arbitrary post under certain conditions.
Additionally, a second issue affecting Contributor roles was fixed. It exposed URL slugs of drafts and pending posts that should not have been visible to the user.
XML-RPC and comments also received security patches
In XML-RPC functionality, a bug was fixed that allowed publishing customize_changeset post types in a way that bypassed the edit_css permission checks required to edit custom CSS.
In the comment system, any logged-in user was able to reassign comments, including notes, under different content. This loophole was also closed in WordPress 7.1.1.
An information disclosure bug in the attachment_submitbox_metadata() function was patched as well. Due to missing read_post capability checks, a private parent post’s title could be revealed to users.
Dozens of other WordPress bugs fixed
Alongside the security patches, WordPress 7.1.1 serves as a maintenance release. A total of 17 bugs in WordPress Core and 21 in the block editor were fixed.
Consequently, the update doesn’t focus solely on security, but also resolves general issues discovered following the August release of WordPress 7.1.
WordPress 7.1.1 is a short-cycle release. The next major release, WordPress 7.2, is currently scheduled for release in December 2026.
Security patches released for older WordPress versions
The WordPress security team didn’t restrict patches to version 7.1 alone. Where necessary, security fixes were backported to older WordPress branches as far back as version 4.7.
For example, WordPress 7.0 received version 7.0.5, WordPress 6.9 received version 6.9.8, and WordPress 6.8 received version 6.8.9. All three of these earlier branches were affected by all 11 security issues fixed in WordPress 7.1.1.
For even older versions of WordPress, the number of patched vulnerabilities varies depending on which issues affected that specific version. WordPress 4.7 received security release 4.7.36, fixing six vulnerabilities.
WordPress 4.6 and older versions no longer receive security updates.
WordPress developers emphasize that only the newest version of the CMS is actively supported. Therefore, backporting security fixes to older branches does not mean using them is recommended.
Install WordPress 7.1.1 as soon as possible
WordPress 7.1.1 can be installed directly from the admin dashboard by navigating to Dashboard → Updates → Update Now. On websites where automatic background updates are enabled, the security release should install automatically.
Given that the update resolves 11 different security issues at once, it’s worth checking whether your website has already updated to version 7.1.1. Before updating manually, it is recommended to take a fresh backup of the website and database, and to check that your plugins and theme function properly after the update.
