WordPress rushes out 7.1.1 with 11 security fixes

WordPress shipped version 7.1.1 on 17 September as a combined maintenance and security release, and the project is telling site owners to update straight away. The release note carries 17 bug fixes in core, 19 more for the block editor and 11 security fixes, which is a busy afternoon for what the project calls a short-cycle release. The next major version, 7.2, is currently pencilled in for December.

What is actually in the box

This is not one dramatic hole with a logo and a countdown. It is a tidy sweep of ordinary, plausible bugs, and the interesting thing about the list is how ordinary it looks. A stored cross-site scripting flaw in wpautop() lets an unauthenticated visitor inject script, subject to comment approval, and was reported by Rafie Muhammad of Awesome Motive. The HTML API function set_modifiable_text() could be coaxed into breaking out of an HTML comment using abrupt-closing sequences. Themes that support custom headers carried their own stored cross-site scripting bug. All three were reported by or alongside Jeremy Felt of the WordPress Security Team.

The one that installs a theme for you

The most uncomfortable entry is a flaw where specially crafted URLs can automatically install and preview an inactive theme hosted on WordPress.org. Reported by Paulos Yibelo and pwn.ai, it turns a link into an action, which is exactly the kind of assumption a lot of people still make incorrectly in 2026. Alongside it, a site administrator could network-activate an installed plugin that is meant to be restricted to network use, reported by Jesse McNeil, and XML-RPC could be used to publish customize_changeset posts that bypassed the edit_css capability check, reported by Ben Bidner.

Anthropic turns up in the credits twice

Two of the eleven fixes credit Anthropic: an authenticated path traversal in the WP REST Templates controller and a contributor-level flaw that allowed arbitrary post overwrite. Two more are disclosure and tidiness failures rather than takeovers. A missing read_post check in attachment_submitbox_metadata() leaked the title of a private parent post, reported by HDWSec, and a missing authorisation check handed contributors and above the slugs of draft and pending posts, reported by Jakub Herman. Finally, comments, notes included, could be reparented by any authenticated user, reported by Justin Hart of Viridis Security.

Who needs to move today

Anyone still on 7.1 or earlier, which in practice means anyone who has not updated since the last short-cycle release. WordPress is available from WordPress.org, through the dashboard updater, and automatically on sites that accept background updates. If you have ever assumed your host handles it, this is a good week to check that assumption, because several of these flaws need nothing more than a comment box or a contributor account.

Our opinion

The pattern here is worth more attention than any single entry. Most of these bugs need a low-privilege account, an approval queue or a click, and each one would be footnote material on a small site. WordPress is not a small site. It is the reason a comment-approval bypass is a mass event rather than a curiosity, and it is why the project's habit of folding security work into routine maintenance releases deserves more credit than it gets. The second observation is quieter and, to my mind, more interesting: two of the eleven fixes came from a company whose day job is building the models, not auditing PHP. Vulnerability research is drifting toward the labs, and a CMS that ships fixes sourced from all of them is better off for it. Update, then forget about it until December.