Direct answer: WordPress 7.1.1 is a security and maintenance update released on September 17, 2026. If your site is on WordPress 7.1, take a verified backup, update to 7.1.1, clear caches, and test login, editing, forms, and any checkout flow. WordPress recommends updating immediately. The release announcement lists 11 security fixes, plus 17 Core and 19 Block Editor bug fixes. Official release announcement.
WordPress 7.1.1: what changed
- Security: 11 vulnerabilities are individually listed by WordPress.
- Maintenance: 17 Core bug fixes and 19 Block Editor fixes are reported in the release announcement.
- Update route: Dashboard → Updates → Update Now, or use WP-CLI if you manage the site from the command line.
- Older branches: security backports are available for supported historical branches, but WordPress says only the latest version is actively supported.
Important source note: the official release post says 11 security fixes, while the summary on the official version documentation currently says 12 before its detailed security section lists 11 vulnerabilities. This guide uses the 11 individually documented issues rather than guessing at a twelfth issue. See the WordPress 7.1.1 version documentation.
Do this now: safe update checklist
1. Confirm your current WordPress version
In wp-admin, open Dashboard → Updates. With WP-CLI, run:
wp core version
wp core check-updateThe official WordPress version-check API currently offers 7.1.1 as the upgrade release and security backports for older branches. Check the live WordPress version API.
2. Create a restorable backup
Back up both the database and files. A backup is useful only if you know where it is stored and how to restore it. For a business-critical, membership, LMS, or WooCommerce site, update a staging copy first.
3. Update WordPress Core
Use Dashboard → Updates → Update Now, or run:
wp core update --version=7.1.1
wp core update-dbIf the site is intentionally held on an older major branch, install the matching security backport listed in the official documentation. Do not jump major versions blindly on a complex production site.
4. Clear every cache layer
- Clear the WordPress caching plugin.
- Purge the host/server cache.
- Purge the CDN cache if one is active.
- Open the homepage and a key inner page in a private browser window.
5. Run a five-minute smoke test
- Front end: homepage, navigation, search, and one representative post or product.
- Admin: sign in, open the editor, edit a test draft, preview it, and save it.
- Forms: submit a contact or lead form and confirm delivery.
- Commerce: test cart, checkout, payment sandbox, and order email if applicable.
- REST/API: confirm integrations and mobile apps still connect.
- Logs: check PHP and server error logs for new errors after the update.
The security issues fixed
The official documentation describes fixes covering stored cross-site scripting, crafted theme-preview URLs, authenticated path traversal in the REST templates controller, arbitrary post overwrite for Contributor-level users and above, XML-RPC capability bypass, disclosure of private or unpublished information, multisite plugin activation, HTML comment handling, and comment reparenting authorization.
Some issues require authentication or a particular role; one listed stored-XSS route is described as unauthenticated but subject to comment approval. The announcement does not state that these flaws are being actively exploited, so do not treat unverified exploit claims as fact. The practical response is still to patch promptly because WordPress labels this a security release and recommends immediate updating.
Which older WordPress versions received fixes?
The official documentation lists security releases from WordPress 7.0.5 through 4.7.36, with the number of applicable fixes varying by branch. It also says WordPress 4.6 and earlier no longer receive security updates. Examples include:
| Installed branch | Documented security release |
|---|---|
| 7.1 | 7.1.1 |
| 7.0 | 7.0.5 |
| 6.9 | 6.9.8 |
| 6.8 | 6.8.9 |
| 6.7 | 6.7.8 |
| 6.6 | 6.6.8 |
| 6.5 | 6.5.11 |
| 4.7 | 4.7.36 |
Use the official version page for the complete branch list. Staying on a backport may reduce immediate compatibility risk, but it is not the same as running the currently supported WordPress version.
If the update breaks your site
- Record the exact error before changing anything else.
- Disable page/CDN caching and retest.
- Check the PHP error log and browser console.
- If wp-admin works, temporarily deactivate the plugin implicated by the error.
- Restore the known-good backup if the site cannot be stabilized quickly.
- Reproduce the failure on staging and update the conflicting theme or plugin before retrying.
Avoid updating Core, all plugins, the theme, PHP, and server rules in one uncontrolled batch. One change at a time makes rollback and diagnosis much safer.
FAQ
Is WordPress 7.1.1 a security update?
Yes. WordPress calls 7.1.1 a security and maintenance release and recommends updating immediately.
Does WordPress 7.1.1 fix 11 or 12 security issues?
The official release announcement says 11, and the detailed documentation lists 11 vulnerabilities. The same documentation page currently contains a summary line saying 12. Until WordPress reconciles that inconsistency, 11 individually documented security issues is the defensible count.
Will WordPress update automatically?
The release announcement says automatic background updates will begin on sites that support them. Verify the installed version rather than assuming the update completed.
Should I update WooCommerce sites immediately?
Patch promptly, but use a current backup and preferably staging. Afterward, test product pages, cart, checkout, payment processing, order creation, and transactional emails.