WordPress.org shipped version 7.1.1 on September 17, a maintenance and security release with 17 core bug fixes, 19 Block Editor fixes, and 11 security fixes. WordPress.org calls it a security release and recommends you update immediately.

What happened

Most of the security fixes close ways a lower-privilege user, like a contributor or a site commenter, could do more than they should. WordPress.org’s release notes describe several issues: stored cross-site scripting in the wpautop() function that lets an unauthenticated visitor inject script through a comment, a stored XSS bug in themes that support custom headers, and a way for a Contributor-level user to overwrite posts they shouldn’t have access to. Other fixes close gaps that let crafted URLs install and preview an inactive theme, or let XML-RPC requests bypass a permissions check.

Two of the 11 fixes were reported by Anthropic: an authenticated path traversal in the WP REST Templates Controller, and the Contributor+ arbitrary post overwrite issue.

None of the fixes require you to do anything beyond updating. WordPress.org has not indicated any of these bugs are under active attack.

What to do

  1. Update to WordPress 7.1.1 now. Go to your WordPress Dashboard, click Updates, then click Update Now.
  2. If your site supports automatic background updates, it should already be updating without action from you.
  3. WordPress 7.1.1 is a short-cycle release. The next major version, 7.2, is planned for December.

End of article