# WordPress security releases in 2026: every fix listed

WordPress shipped nine security releases between March and October 2026. Three of the flaws they fixed — two in 7.0.2 and one in 7.1.2 — are on CISA’s…

Source: https://webkodingtheme.com/blog/wordpress-security-releases-2026/

---

WordPress

# WordPress security releases in 2026: every fix listed

AÖ Arif Özelci · Published 30 Oct 2026 · 7 min read
WordPress shipped nine security releases between March and October 2026. Three of the flaws they fixed — two in 7.0.2 and one in 7.1.2 — are on CISA’s list of actively exploited vulnerabilities. Here is every release, what it fixed, and how to confirm your site is on a patched version.

## Which version you should be on (30 October 2026)

Branch Patched release Notes
7.1 7.1.4 (28 October) Current major, released 19 August
7.0 7.0.8 (28 October) Released 20 May; minimum PHP 7.4
6.9 and older Latest point release of the branch Fixes are backported to every branch from 4.7, but sites on PHP 7.2/7.3 are stuck on 6.9
Check yours in Dashboard → Updates, or at the bottom of any wp-admin screen. WordPress installs minor security releases automatically unless auto-updates were turned off — in that case, every row below is a fix your site does not have.

## The three flaws attackers are using

CVE Fixed in What it is Added to CISA KEV
CVE-2026-60137 7.0.2, 6.9.5, 6.8.6 (17 July) SQL injection 21 July 2026
CVE-2026-63030 7.0.2, 6.9.5 (17 July) REST API batch-route confusion combined with SQL injection, leading to remote code execution 21 July 2026
CVE-2026-87902 7.1.2 (22 September) Unauthenticated: page-template resolution can be made to include a local PHP file, leading to remote code execution 25 September 2026
For 7.0.2 the WordPress security team turned on forced automatic updates, which it reserves for the most serious issues. Versions before 6.8 were not affected by those two. CVE-2026-87902 was fixed in every branch back to 4.7.

## Every 2026 security release

Release Date What it fixed
6.9.2 10 March 10 fixes: blind SSRF, stored XSS in nav menus and via data-wp-bind, authorization bypass in the query-attachments AJAX action, PclZip path traversal, XXE in getID3, a ReDoS and others
6.9.4 11 March Re-applied three fixes (PclZip, Notes, getID3) that were not fully applied in 6.9.2 and 6.9.3
7.0.2 17 July One critical and one high-severity issue — the two exploited CVEs above. Forced auto-update
7.0.3 6 August 12 fixes, including a pre-authentication reflected XSS on the login screen that can lead to PHP code execution (CVE-2026-64638), multisite privilege escalation and SSRF to link-local addresses
7.0.4 12 August Author-level remote code execution through a malicious upload on sites using Imagick with Ghostscript (CVE-2026-65640)
7.1.1 17 September 11 fixes, including unauthenticated stored XSS in wpautop(), path traversal in the REST templates controller and unauthorized theme install
7.1.2 22 September One critical: unauthenticated local file inclusion to remote code execution (CVE-2026-87902)
7.1.3 6 October 7 fixes: stored XSS in the Comments screen, second-order SQL injection in the WXR export, unauthenticated disclosure of comments on private posts, and others
7.1.4 28 October 12 fixes, including a weakness in the upgrade process allowing remote code execution during the upgrade window and stored XSS in the Interactivity API; root certificates updated

## PHP requirements changed in 7.0

WordPress 7.0 dropped PHP 7.2 and 7.3 — together under 4% of sites — and now needs PHP 7.4 at minimum. WordPress.org recommends PHP 8.3 or newer and MySQL 8.0+ or MariaDB 10.11+. A site on PHP 7.2 or 7.3 keeps getting 6.9 security releases but no new features. Note that WordPress core being current does not protect you from flaws in PHP itself: the October PHP2Shell vulnerability is fixed by updating PHP, not WordPress — see what to do about PHP2Shell .

## What to do

- Confirm you are on 7.1.4, 7.0.8 or the latest release of your branch.
- If auto-updates for minor releases are off (WP_AUTO_UPDATE_CORE set to false, or a host or plugin disabling them), turn them back on or update by hand the day a release ships.
- If you were behind during July or September, look for admin accounts you did not create and unfamiliar PHP files in wp-content/uploads.
- Update PHP and plugins as well: core is the smallest part of the attack surface.
Sources: the release posts on wordpress.org/news, the CISA Known Exploited Vulnerabilities catalog, and make.wordpress.org/core for the PHP change.

AÖ
Arif Özelci Builds the WebKoding plugins. Answers support himself.
Share on X LinkedIn Copy link
In this article Which version you should be on (30 October 2026) The three flaws attackers are using Every 2026 security release PHP requirements changed in 7.0 What to do
Related WordPress plugin vulnerabilities in 2026: the worst ones WooCommerce security updates in 2026: what changed PHP security releases in 2026: which ones affect WordPress