The latest core security releases, what to update, and which WordPress and PHP versions no longer get fixes. Refreshed 1 minute ago.
What to do now
Security
WordPress 7.1.4 security release
Fixes a weakness in the upgrade process that can lead to remote code execution during the upgrade window, several stored XSS issues (block markup, Interactivity API, Customizer selective refresh, Categories, Playlist, image and comments pagination blocks), leaking of unpublished Customizer changesets, and Notes readable by users who cannot edit the post. Root certificates were updated after the eMudhra revocation.
Update to WordPress 7.1.4 now; fixes are being backported to older branches down to 4.7.
The PHP project fixed two critical vulnerabilities that affect any PHP application, not only WordPress. No WordPress update is required. PHP versions before 8.2 no longer receive security updates from the PHP project.
Update PHP on every server now and move sites off PHP 8.1 or older (check Tools → Site Health → Info → Server).
Session initialization data is now limited to 4 KiB to prevent oversized data from causing repeated database failures; affected clients must reconnect once. In 0.7.1, an ability not exposed through MCP returns ability_not_found instead of ability_not_public_mcp.
Update to MCP Adapter 0.7.1 (or 0.6.2 for Composer users on 0.6.x) and stop matching on ability_not_public_mcp.
Seven security fixes, including a stored XSS on the Comments admin page, a DoS in WP_Http::make_absolute_url(), a second-order SQL injection in WXR export, Author users able to sticky posts, unauthenticated disclosure of comments on private posts, and forgeable parameters to the {status}_{type} hook.
Update to WordPress 7.1.3 or later (7.1.4 is current).
An unauthenticated attacker could, under certain conditions, make page template resolution include a readable local PHP file outside the active theme, which can lead to remote code execution (CVE-2026-87902).
Fixes include stored XSS in wpautop(), an HTML API set_modifiable_text() comment breakout, authenticated path traversal in the REST Templates controller, Contributor+ arbitrary post overwrite, and comments (including notes) that any logged-in user could reparent.
