{"id":6656,"date":"2026-09-17T19:53:09","date_gmt":"2026-09-17T19:53:09","guid":{"rendered":"https:\/\/frontlinenewsng.org\/?p=6656"},"modified":"2026-09-17T19:53:09","modified_gmt":"2026-09-17T19:53:09","slug":"wordpress-org-blog-wordpress-7-1-1-maintenance-and-security-release","status":"publish","type":"post","link":"https:\/\/frontlinenewsng.org\/?p=6656","title":{"rendered":"WordPress.org blog: WordPress 7.1.1 Maintenance and Security Release"},"content":{"rendered":"<p class=\"wp-block-paragraph\">This security and maintenance release features <a href=\"https:\/\/core.trac.wordpress.org\/query?milestone=7.1.1&amp;status=closed&amp;group=status&amp;order=priority\">17 bug fixes on Core<\/a>, <a href=\"https:\/\/github.com\/WordPress\/gutenberg\/pull\/82383\">19 bug fixes for the Block Editor<\/a>, and 11 security fixes.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Because this is a security release, it is recommended that you update your sites immediately.<\/strong><\/p>\n<p class=\"wp-block-paragraph\">You can <a href=\"https:\/\/wordpress.org\/wordpress-7.1.1.zip\">download WordPress 7.1.1 from WordPress.org<\/a>, or visit your WordPress Dashboard, click \u201cUpdates\u201d, and then click \u201cUpdate Now\u201d. If you have sites that support automatic background updates, the update process will begin automatically.<\/p>\n<p class=\"wp-block-paragraph\">WordPress 7.1.1 is a short-cycle release. The next major release will be <a href=\"https:\/\/make.wordpress.org\/core\/7-2\/\">version 7.2<\/a> and is currently planned for December.<\/p>\n<p class=\"wp-block-paragraph\">For more information, please visit the <a href=\"https:\/\/wordpress.org\/documentation\/wordpress-version\/version-7-1-1\/\">WordPress 7.1.1 HelpHub site<\/a>.<\/p>\n<h2 class=\"wp-block-heading\">Security updates included in this release<\/h2>\n<p class=\"wp-block-paragraph\">The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:<\/p>\n<ul class=\"wp-block-list\">\n<li>Stored cross-site scripting in <code>wpautop()<\/code> allows an unauthenticated visitor to inject script (subject to comment approval), reported by <a href=\"https:\/\/www.linkedin.com\/in\/rafiemuhammad\/\">Rafie Muhammad<\/a> (Awesome Motive, Inc.).<\/li>\n<li>HTML API: <code>set_modifiable_text()<\/code> allows breaking out of a comment via abrupt-closing sequences, reported by <a href=\"https:\/\/happyprime.co\/\">Jeremy Felt<\/a> of the WordPress Security Team.<\/li>\n<li>Stored XSS in some themes that support custom headers, reported by <a href=\"https:\/\/happyprime.co\/\">Jeremy Felt<\/a> of the WordPress Security Team.<\/li>\n<li>Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and <a href=\"https:\/\/pwn.ai\/\">pwn.ai<\/a>.<\/li>\n<li>Site Administrator can network-activate an installed Network-only plugin, reported by <a href=\"https:\/\/profiles.wordpress.org\/buffer1024\/\">Jesse McNeil<\/a>.<\/li>\n<li>Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.<\/li>\n<li>XML-RPC can be used to publish <code>customize_changeset<\/code> posts that bypass checks for <code>edit_css<\/code>, reported by Ben Bidner of the WordPress Security Team.<\/li>\n<li>Contributor+ Arbitrary Post Overwrite, reported by Anthropic.<\/li>\n<li>Missing <code>read_post<\/code> check in <code>attachment_submitbox_metadata()<\/code> leaks a private parent-post title, reported by <a href=\"https:\/\/hdwsec.fr\/\">HDWSec<\/a>.<\/li>\n<li>Missing Authorization leads to Draft\/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.<\/li>\n<li>Comments, including notes, can be reparented by any authenticated user, reported by viridis.<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">Thank you to these WordPress contributors<\/h2>\n<p class=\"wp-block-paragraph\">This release was led by <a href=\"https:\/\/profiles.wordpress.org\/adamsilverstein\/\">Adam Silverstein<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/adrianduffell\/\">Adrian Duffell<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/andraganescu\/\">Andrei Draganescu<\/a>, and <a href=\"https:\/\/profiles.wordpress.org\/jorbin\/\">Aaron Jorbin<\/a>.<\/p>\n<p class=\"wp-block-paragraph\">WordPress 7.1.1 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community.<\/p>\n<p class=\"is-style-wporg-props-long wp-block-paragraph\"><a href=\"https:\/\/profiles.wordpress.org\/jorbin\/\">Aaron Jorbin<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/abrahamfariaz\/\">abrahamfariaz<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/adamsilverstein\/\">Adam Silverstein<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/adrianmoldovanwp\/\">Adi Moldovan<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/adrianduffell\/\">Adrian Duffell<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/wildworks\/\">Aki Hamano<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/xknown\/\">Alex Concha<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/afercia\/\">Andrea Fercia<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/andreasca\/\">andreasca<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/andraganescu\/\">Andrei Draganescu<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/aduth\/\">Andrew Duthie<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/andrewserong\/\">Andrew Serong<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/oandregal\/\">Andr\u00e9 Maneiro<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/annezazu\/\">annezazu<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/antwonw\/\">Anthony White<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/arkaprabhachowdhury\/\">Arkaprabha Chowdhury<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/fushar\/\">Ashar Fuadi<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/azragh\/\">Azragh<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/barry\/\">Barry<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/buffer1024\/\">buffer1024<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/jack960330\/\">Chunhui Ouyang<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/courane01\/\">Courtney Robertson<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/dugi-digitaly\/\">Dagan<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/talldanwp\/\">Daniel Richards<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/villanovachile\/\">Daniel Rodriguez<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/darshitrajyaguru97\/\">Darshit Rajyaguru<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/davidbinda\/\">David Bi\u0148ovec<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/iamchitti\/\">Deepak Kumar<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/dmsnell\/\">Dennis Snell<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/saiful09\/\">DevSaiful<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/dhruvang21\/\">Dhruvang21<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/ocean90\/\">Dominik Schilling<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/ehtis\/\">Ehtisham Siddiqui<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/ellatrix\/\">Ella Van Durpe<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/r1k0\/\">Erick Wambua<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/fahimmurshed\/\">FahimMurshed<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/fernandot\/\">Fernando Tellado<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/fiocavallari\/\">fiocavallari<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/mamaduka\/\">George Mamadashvili<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/poseidonas\/\">George Vasiliades<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/gregbenz\/\">gregbenz<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/harishtewari\/\">Harish Tewari<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/hbhalodia\/\">Hit Bhalodia<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/isabel_brison\/\">Isabel Brison<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/whyisjake\/\">Jake Spurlock<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/jdab\/\">Jamie D\u0105browiecki<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/audrasjb\/\">Jb Audras<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/jeffpaul\/\">Jeffrey Paul<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/jeremyfelt\/\">Jeremy Felt<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/kimjiwoon\/\">Jiwoon Kim<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/joedolson\/\">Joe Dolson<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/joehoyle\/\">Joe Hoyle<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/joemcgill\/\">Joe McGill<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/joen\/\">Joen Asmussen<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/timse201\/\">Johannes J\u00fclg<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/johnbillion\/\">John Blackbourn<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/jonsurrell\/\">Jon Surrell<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/desrosj\/\">Jonathan Desrosiers<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/jmccallweb\/\">Josh<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/ekamran\/\">Kamran Abdul Aziz<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/khokansardar\/\">Khokan Sardar<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/kirasong\/\">Kira Schroder<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/kleisauke\/\">kleisauke<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/kush123\/\">Kushagra Goyal<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/l1onofjudah\/\">l1onofjudah<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/lancewillett\/\">Lance Willett<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/luksusspokoju\/\">luksusspokoju<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/manzoorwanijk\/\">Manzoor Wani<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/mciampini\/\">Marco Ciampini<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/marcs0h\/\">marcs0h<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/tyxla\/\">Marin Atanasov<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/mgyura\/\">Michael<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/batmoo\/\">Mohammad Jangda<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/mrkenobi\/\">mrkenobi<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/mukesh27\/\">Mukesh Panchal<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/nkpathan\/\">Nawazkhan Pathan<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/ntsekouras\/\">Nik Tsekouras<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/parthjoginyusoft\/\">Parth Jogi<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/swissspidy\/\">Pascal Birchler<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/pbiron\/\">Paul Biron<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/paulkevan\/\">Paul Kevan<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/peterwilsoncc\/\">Peter Wilson<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/rafiem\/\">Rafie Muhammad<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/ramonopoly\/\">ramonopoly<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/wprashed\/\">Rashed Hossain<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/ressl\/\">Ressl<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/youknowriad\/\">Riad Benguella<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/rfaile313\/\">Rudy Faile<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/sainathpoojary\/\">Sainath Poojary<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/sc0ttkclark\/\">Scott Kingsley Clark<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/sergeybiryukov\/\">Sergey Biryukov<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/shailu25\/\">Shail Mehta<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/shameemreza\/\">Shameem \u2013 a11n<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/siliconforks\/\">siliconforks<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/slaffik\/\">Slava Abakumov<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/sabernhardt\/\">Stephen Bernhardt<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/sukhendu2002\/\">Sukhendu Sekhar Guria<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/ugyensupport\/\">Ugyen Dorji<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/utsavladani\/\">Utsav Ladani<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/vortfu\/\">vortfu<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/westonruter\/\">Weston Ruter<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/w3bdsgn\/\">w3bdsgn<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/wolf45\/\">wolf45<\/a> plus representatives from Automattic, Bluehost, GoDaddy, Pantheon, and WP Engine.<\/p>\n<h2 class=\"wp-block-heading\">Backports<\/h2>\n<p class=\"wp-block-paragraph\">As a courtesy, the security fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, <strong>only the most recent version of WordPress is actively supported<\/strong>. The backports are in progress and will ship as they become ready.<\/p>\n<h2 class=\"wp-block-heading\">How to contribute<\/h2>\n<p class=\"wp-block-paragraph\">To get involved in WordPress core development, head over to Trac, <a href=\"https:\/\/core.trac.wordpress.org\/report\/6\">pick a ticket<\/a>, and join the conversation in the <a href=\"https:\/\/wordpress.slack.com\/archives\/C02RQBWTW\">#core<\/a> channel. Need help? Check out the <a href=\"https:\/\/make.wordpress.org\/core\/handbook\/\">Core Contributor Handbook<\/a>.<\/p>\n<p class=\"wp-block-paragraph\"><em>Props to <a href=\"https:\/\/profiles.wordpress.org\/ehtis\/\">Ehtisham Siddiqui<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/lancewillett\/\">Lance Willett<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/westonruter\/\">Weston Ruter<\/a>, and <a href=\"https:\/\/profiles.wordpress.org\/adamsilverstein\/\">Adam Silverstein<\/a> for proofreading.<\/em><\/p>\n<p class=\"wp-block-paragraph\">\n<\/p>","protected":false},"excerpt":{"rendered":"<p>This security and maintenance release features 17 bug fixes on Core, 19 bug fixes for the Block Editor, and 11 security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.1 from WordPress.org, or visit your WordPress Dashboard, click \u201cUpdates\u201d, and then click \u201cUpdate [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_seo_schema_type":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1],"tags":[],"class_list":["post-6656","post","type-post","status-publish","format-standard","hentry","category-latest-news"],"jetpack_likes_enabled":true,"jetpack-related-posts":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=\/wp\/v2\/posts\/6656","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6656"}],"version-history":[{"count":0,"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=\/wp\/v2\/posts\/6656\/revisions"}],"wp:attachment":[{"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6656"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6656"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/frontlinenewsng.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6656"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}