WordPress.org shipped version 7.1.1 on September 17, a maintenance and security release with 17 core bug fixes, 19 Block Editor fixes, and 11 security fixes. WordPress.org calls it a security release and recommends you update immediately.
What happened
Most of the security fixes close ways a lower-privilege user, like a contributor or a site commenter, could do more than they should. WordPress.org’s release notes describe several issues: stored cross-site scripting in the wpautop() function that lets an unauthenticated visitor inject script through a comment, a stored XSS bug in themes that support custom headers, and a way for a Contributor-level user to overwrite posts they shouldn’t have access to. Other fixes close gaps that let crafted URLs install and preview an inactive theme, or let XML-RPC requests bypass a permissions check.
Two of the 11 fixes were reported by Anthropic: an authenticated path traversal in the WP REST Templates Controller, and the Contributor+ arbitrary post overwrite issue.
None of the fixes require you to do anything beyond updating. WordPress.org has not indicated any of these bugs are under active attack.
What to do
- Update to WordPress 7.1.1 now. Go to your WordPress Dashboard, click Updates, then click Update Now.
- If your site supports automatic background updates, it should already be updating without action from you.
- WordPress 7.1.1 is a short-cycle release. The next major version, 7.2, is planned for December.
End of article