WordPress 7.1.1 Maintenance and Security Release  🔗 **Source:** [WordPress 7.1.1 Maintenance and Security Release](https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/) > [!note]+ Document Notes > --- > tags: [wordpress-core, security-release, wordpress-7-1-1, release-announcement, responsible-disclosure] > author: WordPress News > source: wordpress.org > reference: https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/ > date created: 2026-09-18 > --- > > [!info] Generated analysis — not the author's words. Sections below are machine-written > > from the captured source. Only text inside `> [!quote]` blocks is verbatim from the author. > > Do not quote or attribute any other line to the named author. > <!-- deep-read: light-touch --> > Light-touch: a ~606-word official release announcement — a thin, factual source whose value is the exact counts, credits, and upgrade instruction. > ## 🏷️ Title > WordPress 7.1.1 Maintenance and Security Release — WordPress News (wordpress.org), 2026. > ## 🧭 Table of Contents > 1. Fix counts and upgrade instruction > 2. Release-cycle context (short-cycle; 7.2 in December) > 3. Security updates included (11 items, with reporters) > 4. Contributor credits > 5. Backports policy > ## 🔗 References (in-page) > Densely linked: the Core Trac 7.1.1 milestone query; Gutenberg PR 82383; the wordpress-7.1.1.zip download; the Make/Core 7.2 page; the 7.1.1 HelpHub page; reporter links (Rafie Muhammad, Jeremy Felt/Happy Prime, pwn.ai, Jesse McNeil, HDWSec); ~95 contributor profiles; Trac report 6; the #core Slack channel; the Core Contributor Handbook. This source is not uncited. > ## 📝 Summary > **What happened:** WordPress 7.1.1 shipped with 17 bug fixes on Core, 19 bug fixes for the Block Editor, and 11 security fixes. It is a short-cycle release; the next major is 7.2, planned for December. > **Why it matters:** Because it is a security release, the post recommends updating immediately. Sites supporting automatic background updates begin automatically; others use Dashboard → Updates → Update Now, or the .zip. > **Stakeholders:** Site owners and administrators, hosts (Automattic, Bluehost, GoDaddy, Pantheon, WP Engine are credited), the Security Team, Core committers, and the credited external researchers. > **Risks:** Disclosed classes: stored XSS (`wpautop()`, and some themes with custom headers); an HTML API comment breakout via `set_modifiable_text()`; unauthenticated theme install/preview via crafted URLs; four authorization gaps (network-only plugin activation, Contributor+ post overwrite, slug disclosure, comment reparenting); a parent-post title leak from a missing `read_post` check; an authenticated path traversal in WP REST Templates; an XML-RPC `edit_css` bypass. No CVE IDs, severity ratings, or affected-version ranges are stated — withheld, as is typical during a disclosure window. > **Bottom line:** Update now; backports to all branches eligible for security fixes (currently through 4.7) are in progress and ship as ready. > ## 📖 Main Content > The announcement does three jobs in ~600 words: state the fix counts, tell people to update, credit the humans involved. Two governance notes follow — the short-cycle framing with 7.2 in December, and the backport courtesy paired with the reminder that only the most recent version of WordPress is actively supported. > The security list is unusually legible: each item names mechanism and reporter. Two are credited to Anthropic (the REST Templates path traversal and the Contributor+ post overwrite) — a data point for AI-assisted security research entering Core disclosure. Three come from Security Team members (Jeremy Felt ×2, Ben Bidner); the rest from independent or vendor researchers. > ### 🗒️ Notes > - Counts as stated: 17 Core bug fixes, 19 Block Editor bug fixes, 11 security fixes. > - Short-cycle release; next major is 7.2, planned for December. > - Auto-update: sites supporting automatic background updates begin the update automatically. > - Backports go to all branches eligible for security fixes, "currently through 4.7," in progress. > - ~95 named contributors plus representatives from five hosting companies. Courtney Robertson (courane01) is credited. > - Contribution on-ramp: Trac report 6, #core Slack, Core Contributor Handbook. > ## 📚 References > Primary sources, all linked from the post: the announcement itself; the Trac 7.1.1 milestone query; Gutenberg PR #82383; wordpress.org/wordpress-7.1.1.zip; make.wordpress.org/core/7-2/; the 7.1.1 HelpHub page; Trac report 6; the Core Contributor Handbook. No third-party commentary and no CVE database entries are referenced. > ## 🗣️ Paraphrase > *Opening:* 17 Core fixes, 19 Block Editor fixes, 11 security fixes — and because it is a security release, update immediately. > *Upgrade and cycle:* Get it from the .zip or the Dashboard Updates screen; auto-update-capable sites start on their own. 7.1.1 is short-cycle; 7.2 is next, targeted for December. > *Security list:* Eleven vulnerabilities, each with mechanism and credited reporter. > *Credits and backports:* ~95 individuals plus host representatives, their asynchronous coordination framed as evidence of community capability; fixes backported through 4.7 as a courtesy, with only the latest version actively supported. > ## 📰 Newsletter > **Patch day, WordPress edition.** [WordPress 7.1.1](https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/) is out with 17 Core fixes, [19 Block Editor fixes](https://github.com/WordPress/gutenberg/pull/82383), and 11 security fixes. The advice is refreshingly free of hedging: update now. If your host does background updates, it probably already happened while you read that sentence. > The list rewards a slow read: stored XSS in `wpautop()`, a comment escape in the HTML API, a crafted URL that installs and previews an inactive theme without authentication, and a fistful of "Contributor+ can do more than Contributor should" bugs. Two entries are credited to Anthropic. [7.2 lands in December](https://make.wordpress.org/core/7-2/), and backports reach every branch still eligible, back to 4.7 — a courtesy, not a support promise. [Pick a ticket](https://core.trac.wordpress.org/report/6). > ## ✅ Action Items > - **DevRel / OSPO / Marketing:** Push "update immediately" through owned channels within 24 hours, using the exact counts rather than rounded ones. > - **Core / Core Program Team / Core Performance / Core AI:** Publish a backport tracker through 4.7; check whether the `wpautop()` and HTML API changes alter output in benchmarked or generated-content paths. > - **Mobile / Playground / CLI / Hosting / Tide:** Verify builds pick up 7.1.1; refresh Playground default; publicize `wp core update` for fleets; confirm auto-update coverage and report laggards. > - **Support / Documentation / Polyglots / Training:** Stock canned replies with the HelpHub 7.1.1 link; localize the summary; add a "why short-cycle releases" Learn segment. > - **Themes / Plugins:** Retest custom-header support against the stored XSS fix; flag network-only plugin activation assumptions. > - **Community / Design / Accessibility / Meta / Photos / TV / Openverse:** Update owned properties; confirm no regression. > - **The WPOCC / FAIR:** Track whether backport-through-4.7 practice affects federated or independent distribution mirrors. > ## 🧪 Hypotheses > 1. Sites with automatic background updates reach 7.1.1 within 72 hours at a materially higher rate than those without — testable against wordpress.org version-share telemetry. > 2. The unauthenticated stored XSS in `wpautop()` drives faster adoption than a typical minor — a steeper version-share curve versus 7.0.x. > 3. CVE identifiers and severity scores for these 11 issues publish after the disclosure window, not before — watch CVE feeds for 30 days. > 4. Because many issues are Contributor+ only, multi-author sites show higher post-release support-forum chatter than single-author sites. > 5. Anthropic-credited findings recur in later WordPress security releases — count AI-vendor credits across the next four. > ## 📊 Methodology > None stated; this is an announcement, not a study. Its evidentiary basis is the Core Trac 7.1.1 milestone, the Gutenberg pull request, and the Security Team triage — linked but not summarized. Counts are release-team assertions, verifiable against those artifacts. > ## ❓ Questions > - What are the CVE IDs, CVSS scores, and affe This security and maintenance release features [17 bug fixes on Core](https://core.trac.wordpress.org/query?milestone=7.1.1&status=closed&group=status&order=priority), [19 bug fixes for the Block Editor](https://github.com/WordPress/gutenberg/pull/82383), and 11 security fixes. **Because this is a security release, it is recommended that you update your sites immediately.** You can [download WordPress 7.1.1 from WordPress.org](https://wordpress.org/wordpress-7.1.1.zip), or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically. WordPress 7.1.1 is a short-cycle release. The next major release will be [version 7.2](https://make.wordpress.org/core/7-2/) and is currently planned for December. For more information, please visit the [WordPress 7.1.1 HelpHub site](https://wordpress.org/documentation/wordpress-version/version-7-1-1/). #### Security updates included in this release The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release: * Stored cross-site scripting in `wpautop()` allows an unauthenticated visitor to inject script (subject to comment approval), reported by [Rafie Muhammad](https://www.linkedin.com/in/rafiemuhammad/) (Awesome Motive, Inc.). * HTML API: `set_modifiable_text()` allows breaking out of a comment via abrupt-closing sequences, reported by [Jeremy Felt](https://happyprime.co/) of the WordPress Security Team. * Stored XSS in some themes that support custom headers, reported by [Jeremy Felt](https://happyprime.co/) of the WordPress Security Team. * Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and [pwn.ai](https://pwn.ai/). * Site Administrator can network-activate an installed Network-only plugin, reported by [Jesse McNeil](https://profiles.wordpress.org/buffer1024/). * Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic. * XML-RPC can be used to publish `customize_changeset` posts that bypass checks for `edit_css`, reported by Ben Bidner of the WordPress Security Team. * Contributor+ Arbitrary Post Overwrite, reported by Anthropic. * Missing `read_post` check in `attachment_submitbox_metadata()` leaks a private parent-post title, reported by [HDWSec](https://hdwsec.fr/). * Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms. * Comments, including notes, can be reparented by any authenticated user, reported by viridis. #### Thank you to these WordPress contributors WordPress 7.1.1 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community. [Aaron Jorbin](https://profiles.wordpress.org/jorbin/), [abrahamfariaz](https://profiles.wordpress.org/abrahamfariaz/), [Adam Silverstein](https://profiles.wordpress.org/adamsilverstein/), [Adi Moldovan](https://profiles.wordpress.org/adrianmoldovanwp/), [Aki Hamano](https://profiles.wordpress.org/wildworks/), [Alex Concha](https://profiles.wordpress.org/xknown/), [andreasca](https://profiles.wordpress.org/andreasca/), [Andrei Draganescu](https://profiles.wordpress.org/andraganescu/), [Andrew Duthie](https://profiles.wordpress.org/aduth/), [Andrew Serong](https://profiles.wordpress.org/andrewserong/), [André Maneiro](https://profiles.wordpress.org/oandregal/), [annezazu](https://profiles.wordpress.org/annezazu/), [Anthony White](https://profiles.wordpress.org/antwonw/), [Arkaprabha Chowdhury](https://profiles.wordpress.org/arkaprabhachowdhury/), [Azragh](https://profiles.wordpress.org/azragh/), [Barry](https://profiles.wordpress.org/barry/), [buffer1024](https://profiles.wordpress.org/buffer1024/), [Chunhui Ouyang](https://profiles.wordpress.org/jack960330/), [Courtney Robertson](https://profiles.wordpress.org/courane01/), [Dagan](https://profiles.wordpress.org/dugi-digitaly/), [Daniel Richards](https://profiles.wordpress.org/talldanwp/), [Daniel Rodriguez](https://profiles.wordpress.org/villanovachile/), [David Biňovec](https://profiles.wordpress.org/davidbinda/), [Deepak Kumar](https://profiles.wordpress.org/iamchitti/), [Dennis Snell](https://profiles.wordpress.org/dmsnell/), [DevSaiful](https://profiles.wordpress.org/saiful09/), [Dhruvang21](https://profiles.wordpress.org/dhruvang21/), [Dominik Schilling](https://profiles.wordpress.org/ocean90/), [Ehtisham Siddiqui](https://profiles.wordpress.org/ehtis/), [Ella Van Durpe](https://profiles.wordpress.org/ellatrix/), [Erick Wambua](https://profiles.wordpress.org/r1k0/), [FahimMurshed](https://profiles.wordpress.org/fahimmurshed/), [Fernando Tellado](https://profiles.wordpress.org/fernandot/), [fiocavallari](https://profiles.wordpress.org/fiocavallari/), [George Mamadashvili](https://profiles.wordpress.org/mamaduka/), [George Vasiliades](https://profiles.wordpress.org/poseidonas/), [gregbenz](https://profiles.wordpress.org/gregbenz/), [Harish Tewari](https://profiles.wordpress.org/harishtewari/), [Hit Bhalodia](https://profiles.wordpress.org/hbhalodia/), [Isabel Brison](https://profiles.wordpress.org/isabel_brison/), [Jake Spurlock](https://profiles.wordpress.org/whyisjake/), [Jb Audras](https://profiles.wordpress.org/audrasjb/), [Jeffrey Paul](https://profiles.wordpress.org/jeffpaul/), [Jeremy Felt](https://profiles.wordpress.org/jeremyfelt/), [Jiwoon Kim](https://profiles.wordpress.org/kimjiwoon/), [Joe Dolson](https://profiles.wordpress.org/joedolson/), [Joe Hoyle](https://profiles.wordpress.org/joehoyle/), [Joe McGill](https://profiles.wordpress.org/joemcgill/), [Joen Asmussen](https://profiles.wordpress.org/joen/), [Johannes Jülg](https://profiles.wordpress.org/timse201/), [John Blackbourn](https://profiles.wordpress.org/johnbillion/), [Jon Surrell](https://profiles.wordpress.org/jonsurrell/), [Jonathan Desrosiers](https://profiles.wordpress.org/desrosj/), [Josh](https://profiles.wordpress.org/jmccallweb/), [Kamran Abdul Aziz](https://profiles.wordpress.org/ekamran/), [Khokan Sardar](https://profiles.wordpress.org/khokansardar/), [Kira Schroder](https://profiles.wordpress.org/kirasong/), [kleisauke](https://profiles.wordpress.org/kleisauke/), [Kushagra Goyal](https://profiles.wordpress.org/kush123/), [l1onofjudah](https://profiles.wordpress.org/l1onofjudah/), [Lance Willett](https://profiles.wordpress.org/lancewillett/), [luksusspokoju](https://profiles.wordpress.org/luksusspokoju/), [Manzoor Wani](https://profiles.wordpress.org/manzoorwanijk/), [Marco Ciampini](https://profiles.wordpress.org/mciampini/), [marcs0h](https://profiles.wordpress.org/marcs0h/), [Marin Atanasov](https://profiles.wordpress.org/tyxla/), [Michael](https://profiles.wordpress.org/mgyura/), [Mohammad Jangda](https://profiles.wordpress.org/batmoo/), [mrkenobi](https://profiles.wordpress.org/mrkenobi/), [Mukesh Panchal](https://profiles.wordpress.org/mukesh27/), [Nawazkhan Pathan](https://profiles.wordpress.org/nkpathan/), [Nik Tsekouras](https://profiles.wordpress.org/ntsekouras/), [Parth Jogi](https://profiles.wordpress.org/parthjoginyusoft/), [Pascal Birchler](https://profiles.wordpress.org/swissspidy/), [Paul Biron](https://profiles.wordpress.org/pbiron/), [Paul Kevan](https://profiles.wordpress.org/paulkevan/), [Peter Wilson](https://profiles.wordpress.org/peterwilsoncc/), [Rafie Muhammad](https://profiles.wordpress.org/rafiem/), [ramonopoly](https://profiles.wordpress.org/ramonopoly/), [Rashed Hossain](https://profiles.wordpress.org/wprashed/), [Ressl](https://profiles.wordpress.org/ressl/), [Riad Benguella](https://profiles.wordpress.org/youknowriad/), [Rudy Faile](https://profiles.wordpress.org/rfaile313/), [Sainath Poojary](https://profiles.wordpress.org/sainathpoojary/), [Scott Kingsley Clark](https://profiles.wordpress.org/sc0ttkclark/), [Sergey Biryukov](https://profiles.wordpress.org/sergeybiryukov/), [Shail Mehta](https://profiles.wordpress.org/shailu25/), [Shameem – a11n](https://profiles.wordpress.org/shameemreza/), [siliconforks](https://profiles.wordpress.org/siliconforks/), [Slava Abakumov](https://profiles.wordpress.org/slaffik/), [Sukhendu Sekhar Guria](https://profiles.wordpress.org/sukhendu2002/), [Utsav Ladani](https://profiles.wordpress.org/utsavladani/), [vortfu](https://profiles.wordpress.org/vortfu/), [Weston Ruter](https://profiles.wordpress.org/westonruter/), [wolf45](https://profiles.wordpress.org/wolf45/) plus representatives from Automattic, Bluehost, GoDaddy, Pantheon, and WP Engine. #### Backports As a courtesy, the security fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, **only the most recent version of WordPress is actively supported**. The backports are in progress and will ship as they become ready. To get involved in WordPress core development, head over to Trac, [pick a ticket](https://core.trac.wordpress.org/report/6), and join the conversation in the [#core](https://wordpress.slack.com/archives/C02RQBWTW) channel. Need help? Check out the [Core Contributor Handbook](https://make.wordpress.org/core/handbook/)., WordPress 7.1.1 Maintenance and Security Release, WordPress News, 01m2rgeqt7nb35bm4s52f9v1v0.