WordPress 7.1.1: update now for the security fixes

If you run a personal blog, a church site, a family business page, or any other small WordPress install, treat WordPress 7.1.1 as a same-day update. It is a security and maintenance release, not a feature drop you can park for next weekend.

WordPress.org shipped it on September 17, 2026. The official post counts 17 Core bug fixes, 19 Block Editor bug fixes, and 11 security fixes. Because it is a security release, the project recommends updating sites immediately. More detail lives on the 7.1.1 HelpHub page and the release schedule note.

What this release is

7.1.1 is a short-cycle follow-up after 7.1. The next major version is 7.2, currently planned for December. In practice that means: take the security build now, keep an eye on the December major later, and do not wait for 7.2 to pick up these fixes.

Release leads named on the news post include Adam Silverstein, Adrian Duffell, Andrei Draganescu, and Aaron Jorbin. Credit also goes to the reporters who disclosed the security issues responsibly.

Why you should care (without the scary jargon)

You do not need a CVE spreadsheet. You need the gist:

• Some issues involve stored XSS: bad script content that can stick around if comments or certain theme features are abused. One path involves unauthenticated visitors, but still depends on comment approval settings.
• The HTML API had a comment breakout problem that needed a hard fix in core.
• Some themes with custom headers could store XSS in ways that matter once content is rendered.
• Crafted URLs could auto-install and preview an inactive theme from WordPress.org. That is the kind of “I did not mean to install that” surprise you want closed.
• A Site Admin could network-activate a Network-only plugin in ways that should not be allowed.
• An authenticated path traversal issue existed in the REST Templates controller.
• XML-RPC could publish customize changeset posts that skipped edit_css checks.
• Contributor and above could overwrite posts they should not be able to overwrite.
• Missing checks could leak a private parent post title through attachment metadata, and could disclose draft or pending post slugs to Contributors and above.
• Any authenticated user could reparent comments and notes.

Plain takeaway for a home or small site: update. Do not wait to map every bullet to a CVE ID. WordPress also notes these security fixes are being backported to older branches that still receive security updates (through 4.7), while reminding everyone that only the newest WordPress line is actively supported. If you are still on an ancient major, this release is another reason to plan a real upgrade path, not another year of “it still loads.”

If last summer’s emergency WordPress work is still fresh, see our earlier note on WordPress Core CVE-2026-63030. Different bug, same habit: confirm the version that is actually running.

Update WordPress 7.1.1 now

1. Backup first if your host does not already snapshot before updates. A file plus database backup you can restore beats a confident click with no undo.
2. Open Dashboard → Updates.
3. Confirm WordPress core shows 7.1.1 available (or that you are already on it).
4. Click Update Now and wait for the success screen. Do not close the tab mid-flight.
5. If the dashboard cannot reach the updater, download 7.1.1 from WordPress.org and follow your host’s manual update path, or use WP-CLI if you already know that workflow.
6. If the site supports automatic background updates, the process may start on its own. Still log in afterward and verify. Auto-update is helpful, not telepathy.

Managed hosts sometimes pin versions or delay core bumps. If your panel shows an older build after the release window, open a host ticket with a screenshot of Dashboard → Updates and ask them to allow 7.1.1.

Confirm it stuck

After the update:

1. Check Dashboard → Updates (or At a Glance) for the running version: you want 7.1.1.
2. Load the front page and one editor screen. Spot-check comments, media, and any custom header theme options you actually use.
3. Glance at Users if you share the site with Contributors or Authors. Least privilege still matters after a release that touched contributor-level paths.
4. If you maintain more than one public site, write down which domains you updated. Forgotten staging and old campaign sites are how “I thought we patched” turns into a mess. Our public website inventory walkthrough is the longer version of that habit.

Do / don’t

Do

• Update the same day when WordPress calls something a security release
• Verify the version after auto-update claims success
• Keep unused themes and plugins deleted, not merely deactivated
• Keep comment moderation on if you are not actively watching the queue

Don’t

• Skip the update because “it is only a brochure site”
• Leave Contributor accounts lying around for people who no longer help
• Assume an old 4.x or 5.x install is fine forever just because backports exist
• Hunt for exploit writeups instead of clicking Update Now

Bottom line

WordPress 7.1.1 is a short-cycle security and maintenance release with 11 security fixes plus a pile of Core and editor bug fixes. Update from Dashboard → Updates, confirm you are on 7.1.1, and move on with your day. Source of truth: the official WordPress.org news post.

Image: WordPress.org default OG image from the 7.1.1 maintenance and security release news post (og:image wordpress-default-ogimage.png).