WordPress news
Which WordPress security updates came out in fall 2026, and what should I do?
WordPress released three security updates in quick succession: 7.1.1 on September 17, 2026, 7.1.2 on September 22, 2026, and 7.1.3 on October 6, 2026. The WordPress team recommends updating immediately after each security release. If your site shows anything lower than 7.1.3 under Dashboard > Updates, update now.
What each release fixed
WordPress 7.1.1 (September 17, 2026)
A security and maintenance release with 11 security fixes, 17 core bug fixes and 19 block editor bug fixes. The security fixes included several cross-site scripting (XSS) issues, a path traversal issue in the templates system, and permission checks that let lower-level accounts (such as Contributors) see or change things they should not.
WordPress 7.1.2 (September 22, 2026)
A security release with one fix for a vulnerability WordPress rated critical. Under certain server and theme conditions, an attacker who is not logged in could make WordPress load a PHP file from outside the active theme, which could lead to running code on the server. The advisory reference is CVE-2026-87902.
WordPress 7.1.3 (October 6, 2026)
A security and maintenance release with 7 security fixes and 4 bug fixes. The fixes included a stored XSS issue on the Comments admin screen (through pending comments), a way for people who are not logged in to see comments on private and unpublished posts, an XSS issue in Imgur embeds, and a weakness that let Author accounts make posts sticky.
What this means in plain terms
Several of these problems need a specific setup, a certain user role, or a visitor to take an action before they can be used. But attackers scan for sites running older versions, and fixes become public when a release goes out. That is why "update promptly" is the advice even when a single issue sounds unlikely to affect you.
What to do now
- Log in to your WordPress dashboard.
- Go to Dashboard > Updates and check your version.
- If it is lower than 7.1.3, click the button to update.
- Update your plugins and theme on the same screen.
- Visit your homepage, contact form and any store pages to confirm they work.
Sites that support automatic background updates should receive these security releases on their own. It is still worth checking, because some setups turn automatic updates off.
What if I am on an older WordPress version?
The WordPress security team backports security fixes, where needed, to older branches that are eligible for security fixes (currently back to 4.7). WordPress also notes that only the current version is actively supported. If your site is several major versions behind, plan an upgrade. Back up first, update plugins and the theme, then update WordPress, and test.
If you are worried an older theme or plugin will break, contact us before updating.
How backups help
ParsonsHosting keeps offsite backups three times a week (Monday, Tuesday and Friday) on every plan. If an update causes a problem, we can help you restore. For major upgrades, also make your own backup right before you start, and try the upgrade on a staging copy first (staging with WP Toolkit is included on every plan).
Signs your site may already have a problem
- Admin users you do not recognize
- Strange links, pop-ups or redirects
- New comments or posts you did not approve
- A warning from Google or your browser
If you see any of these, email support@parsonshosting.com or call 530-710-8726. We reply the same day, often within an hour, during business hours (8:00 AM to 5:00 PM Pacific, 7 days a week). Do not delete files at random.
Sources
- WordPress 7.1.1 release, September 17, 2026: https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/
- WordPress 7.1.2 release, September 22, 2026: https://wordpress.org/news/2026/09/wordpress-7-1-2-release/
- WordPress 7.1.3 release, October 6, 2026: https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/
- Version 7.1.3 documentation page: https://wordpress.org/documentation/wordpress-version/version-7-1-3/
Keep your site current
See our article on keeping WordPress secure and up to date for a simple weekly routine. ParsonsHosting WordPress hosting includes offsite backups on every plan, and migrations are free regardless of size or time. More in the FAQ.