WordPress security releases in 2026: every fix listed
WordPress shipped nine security releases between March and October 2026. Three of the flaws they fixed — two in 7.0.2 and one in 7.1.2 — are on CISA’s list of actively exploited vulnerabilities. Here is every release, what it fixed, and how to confirm your site is on a patched version.
Which version you should be on (30 October 2026)
| Branch | Patched release | Notes |
|---|---|---|
| 7.1 | 7.1.4 (28 October) | Current major, released 19 August |
| 7.0 | 7.0.8 (28 October) | Released 20 May; minimum PHP 7.4 |
| 6.9 and older | Latest point release of the branch | Fixes are backported to every branch from 4.7, but sites on PHP 7.2/7.3 are stuck on 6.9 |
Check yours in Dashboard → Updates, or at the bottom of any wp-admin screen. WordPress installs minor security releases automatically unless auto-updates were turned off — in that case, every row below is a fix your site does not have.
The three flaws attackers are using
| CVE | Fixed in | What it is | Added to CISA KEV |
|---|---|---|---|
| CVE-2026-60137 | 7.0.2, 6.9.5, 6.8.6 (17 July) | SQL injection | 21 July 2026 |
| CVE-2026-63030 | 7.0.2, 6.9.5 (17 July) | REST API batch-route confusion combined with SQL injection, leading to remote code execution | 21 July 2026 |
| CVE-2026-87902 | 7.1.2 (22 September) | Unauthenticated: page-template resolution can be made to include a local PHP file, leading to remote code execution | 25 September 2026 |
For 7.0.2 the WordPress security team turned on forced automatic updates, which it reserves for the most serious issues. Versions before 6.8 were not affected by those two. CVE-2026-87902 was fixed in every branch back to 4.7.
Every 2026 security release
| Release | Date | What it fixed |
|---|---|---|
| 6.9.2 | 10 March | 10 fixes: blind SSRF, stored XSS in nav menus and via data-wp-bind, authorization bypass in the query-attachments AJAX action, PclZip path traversal, XXE in getID3, a ReDoS and others |
| 6.9.4 | 11 March | Re-applied three fixes (PclZip, Notes, getID3) that were not fully applied in 6.9.2 and 6.9.3 |
| 7.0.2 | 17 July | One critical and one high-severity issue — the two exploited CVEs above. Forced auto-update |
| 7.0.3 | 6 August | 12 fixes, including a pre-authentication reflected XSS on the login screen that can lead to PHP code execution (CVE-2026-64638), multisite privilege escalation and SSRF to link-local addresses |
| 7.0.4 | 12 August | Author-level remote code execution through a malicious upload on sites using Imagick with Ghostscript (CVE-2026-65640) |
| 7.1.1 | 17 September | 11 fixes, including unauthenticated stored XSS in wpautop(), path traversal in the REST templates controller and unauthorized theme install |
| 7.1.2 | 22 September | One critical: unauthenticated local file inclusion to remote code execution (CVE-2026-87902) |
| 7.1.3 | 6 October | 7 fixes: stored XSS in the Comments screen, second-order SQL injection in the WXR export, unauthenticated disclosure of comments on private posts, and others |
| 7.1.4 | 28 October | 12 fixes, including a weakness in the upgrade process allowing remote code execution during the upgrade window and stored XSS in the Interactivity API; root certificates updated |
PHP requirements changed in 7.0
WordPress 7.0 dropped PHP 7.2 and 7.3 — together under 4% of sites — and now needs PHP 7.4 at minimum. WordPress.org recommends PHP 8.3 or newer and MySQL 8.0+ or MariaDB 10.11+. A site on PHP 7.2 or 7.3 keeps getting 6.9 security releases but no new features. Note that WordPress core being current does not protect you from flaws in PHP itself: the October PHP2Shell vulnerability is fixed by updating PHP, not WordPress — see what to do about PHP2Shell.
What to do
- Confirm you are on 7.1.4, 7.0.8 or the latest release of your branch.
- If auto-updates for minor releases are off (WP_AUTO_UPDATE_CORE set to false, or a host or plugin disabling them), turn them back on or update by hand the day a release ships.
- If you were behind during July or September, look for admin accounts you did not create and unfamiliar PHP files in wp-content/uploads.
- Update PHP and plugins as well: core is the smallest part of the attack surface.
Sources: the release posts on wordpress.org/news, the CISA Known Exploited Vulnerabilities catalog, and make.wordpress.org/core for the PHP change.