WordPress 7.1.1 Security Update: 11 Fixes and the Backport Versions to Apply

By AiCybr Editorial · Published September 19, 2026

WordPress 7.1.1, released September 17, 2026, fixes 11 security issues alongside 17 Core bug fixes and 19 Block Editor fixes. WordPress recommends an immediate update. Sites on the 7.1 branch should move to 7.1.1; the project also shipped security backports for older branches, including 7.0.5, 6.9.8 and 6.8.9 on the same date.

The security fixes cover stored cross-site scripting, authenticated path traversal, authorization failures, arbitrary post overwrite, XML-RPC permission bypass and a crafted-URL path that could automatically install and preview an inactive theme from WordPress.org. The official release announcement lists the 11 issues without assigning CVE identifiers, so operators should use the fixed WordPress versions as the remediation boundary.

WordPress says security fixes are being backported where necessary through branches eligible for security fixes, currently back to 4.7. Only the newest WordPress version is actively supported, making 7.1.1 the preferred target where application and plugin compatibility permit the upgrade.

WordPress 7.1.1 at a glance

The primary references are the WordPress 7.1.1 security announcement, the WordPress release archive and the WordPress version history.

The 11 security issues fixed in 7.1.1

WordPress's security team lists the following fixes in the release:

1. Stored XSS in wpautop() — an unauthenticated visitor could inject script, with comment approval required for the demonstrated path.
2. HTML API comment breakout — set_modifiable_text() could break out of a comment through abrupt-closing sequences.
3. Stored XSS in some custom-header themes — affects themes using the relevant custom-header functionality.
4. Automatic inactive-theme installation and preview from crafted URLs — specially constructed URLs could trigger installation and preview of an inactive theme from WordPress.org.
5. Network-only plugin activation authorization issue — a Site Administrator could network-activate an installed Network-only plugin.
6. Authenticated path traversal in the WP REST Templates Controller.
7. XML-RPC customize_changeset permission bypass — XML-RPC could publish customize_changeset posts while bypassing edit_css checks.
8. Contributor-level arbitrary post overwrite.
9. Private parent-post title disclosure — a missing read_post check in attachment_submitbox_metadata() could reveal the title.
10. Draft and pending post slug disclosure to Contributor-level users and above because of missing authorization.
11. Comment and note reparenting by any authenticated user.

The list contains several different privilege and interaction boundaries. Administrators should therefore treat the release as a cumulative Core security update instead of attempting to decide whether a site is exposed to only one item.

Which version should you install?

For sites already running WordPress 7.1, the remediation target is 7.1.1. WordPress.org provides it through Dashboard → Updates and as a direct package, and sites configured for automatic background Core updates should begin receiving it automatically.

The official release archive also records 7.0.5, 6.9.8 and 6.8.9 on September 17 as backport releases. WordPress says the security fixes are being backported where necessary through eligible branches down to 4.7, with additional backports shipping as they become ready.

Older-branch backports are useful where an immediate major-version transition is constrained by application compatibility. WordPress's support policy still identifies the latest release as the actively supported version, so a backport should be paired with a plan to move to a current supported branch.

The crafted-theme-install path deserves special attention

One of the 11 fixes addresses specially crafted URLs that could automatically install and preview an inactive theme from WordPress.org. Independent security reporting has described this issue as part of a chain dubbed Click2Shell, where theme installation can become more consequential when combined with a separate exploitable theme condition.

For WordPress operators, the Core action remains the same regardless of the exploit-chain label: update to a fixed Core release. The official WordPress announcement establishes the vulnerable behavior and the 7.1.1 remediation without publishing a standalone CVE mapping for it.

Update and verification checklist

Inventory the Core version on every public WordPress installation, including staging sites that are internet-accessible. Apply 7.1.1 on the current branch, or the appropriate security backport when a current-branch upgrade is temporarily blocked by compatibility requirements.

After updating, verify the reported Core version in Dashboard → Updates or with your normal fleet-management tooling. Sites using automatic background updates should be checked for successful completion instead of relying solely on the configured update policy.

Administrators running older branches should also review plugin and theme compatibility needed to reach the current WordPress branch. Core backports reduce immediate security exposure; they are not a substitute for maintaining a supported application stack over time.

Exploitation evidence and priority

The official September 17 announcement recommends immediate updating and documents the 11 fixes, but it does not report a general in-the-wild exploitation status for the release. No CVE IDs are supplied in that announcement.

The practical priority is driven by the breadth of the fixes and WordPress's direct security-update recommendation. Public sites on 7.1 should move to 7.1.1 promptly, while operators on older branches should identify the corresponding security backport and schedule migration toward the current supported release.

Sources

• WordPress.org — WordPress 7.1.1 Maintenance and Security Release
• WordPress.org — Release Archive
• WordPress.org — WordPress Versions
• The Hacker News — independent reporting on the crafted-theme-install issue