# WordPress security today

> Core and PHP security releases, which versions still get fixes, and what to update first. Checked every day.

Source: https://mcpforwp.com (MCP for WP, free and read-only). Refreshed 2026-11-03 03:06 UTC.

## Update now

- Latest WordPress: 7.1.4
- 2026-10-28: [WordPress 7.1.4](https://wordpress.org/news/2026/10/wordpress-7-1-4/)
- 2026-10-21: [Critical PHP Security Release](https://wordpress.org/news/2026/10/critical-php-security-release/)
- 2026-10-06: [WordPress 7.1.3 Maintenance and Security Release](https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/)
- 2026-09-22: [WordPress 7.1.2 Release](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/)
- 2026-09-17: [WordPress 7.1.1 Maintenance and Security Release](https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/)

## What to do (from the changelog)

- 2026-10-28: WordPress 7.1.4 security release. Update to WordPress 7.1.4 now; fixes are being backported to older branches down to 4.7. (https://wordpress.org/news/2026/10/wordpress-7-1-4/)
- 2026-10-21: Critical PHP security release. Update PHP on every server now and move sites off PHP 8.1 or older (check Tools → Site Health → Info → Server). (https://wordpress.org/news/2026/10/critical-php-security-release/)
- 2026-10-16: MCP Adapter 0.7.1 and 0.6.2 security fixes. Update to MCP Adapter 0.7.1 (or 0.6.2 for Composer users on 0.6.x) and stop matching on `ability_not_public_mcp`. (https://github.com/WordPress/mcp-adapter/releases/tag/v0.7.1)
- 2026-10-06: WordPress 7.1.3 security and maintenance release. Update to WordPress 7.1.3 or later (7.1.4 is current). (https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/)
- 2026-09-22: WordPress 7.1.2 fixes a critical RCE. Update to WordPress 7.1.2 or later immediately. (https://wordpress.org/news/2026/09/wordpress-7-1-2-release/)
- 2026-09-17: WordPress 7.1.1 fixes 11 security issues. Update to the latest 7.1.x release. (https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/)

## WordPress branches

- WordPress 7.1: latest 7.1.4 (2026-10-28), active, PHP 7.4 - 8.5
- WordPress 7.0: latest 7.0.8 (2026-10-28), security only, PHP 7.4 - 8.5
- WordPress 6.9: latest 6.9.11 (2026-10-28), security only, PHP 7.2.24 - 8.5
- WordPress 6.8: latest 6.8.12 (2026-10-28), security only, PHP 7.2.24 - 8.4
- WordPress 6.7: latest 6.7.11 (2026-10-28), security only, PHP 7.2.24 - 8.4
- WordPress 6.6: latest 6.6.11 (2026-10-28), security only, PHP 7.2.24 - 8.3

## PHP branches

- PHP 8.5: latest 8.5.12, active, security fixes until 2029-12-31
- PHP 8.4: latest 8.4.27, active, security fixes until 2028-12-31
- PHP 8.3: latest 8.3.36, security only, security fixes until 2027-12-31
- PHP 8.2: latest 8.2.35, security only, security fixes until 2026-12-31
- PHP 8.1: latest 8.1.34, end of life, security fixes until 2025-12-31
- PHP 8.0: latest 8.0.30, end of life, security fixes until 2023-11-26

Not covered yet: plugin vulnerabilities. Check WordPress.org and your security scanner.