WordPress has released version 7.1.1, an urgent security and maintenance update designed to address eleven vulnerabilities in its content management system. Website owners and administrators are being warned to apply the update immediately to protect against several serious risks including cross-site scripting, authorization bypasses, information disclosure, path traversal, and content manipulation attacks. Automatic background updates are already rolling out for sites configured accordingly.
What’s Fixed
This update resolves multiple stored cross-site scripting (XSS) vulnerabilities. One vulnerability lies in the wpautop() function, where an unauthenticated visitor could place malicious scripts via comments (assuming comment approval), which could execute in other visitors’ browsers if viewable. Another stored XSS issue affected themes with custom headers. The HTML API also had a vulnerability in the set_modifiable_text() function, where specially crafted abrupt closing sequences could break out of comment contexts and introduce malicious HTML.
Beyond XSS, version 7.1.1 rectifies several flaws that might allow unauthorized changes or unintentional exposure of sensitive information. One such flaw allowed inactive themes from WordPress.org to be automatically installed and previewed through maliciously crafted URLs. There’s also a corrected path traversal vulnerability in the WP REST Templates Controller (reported by a third party), which could allow authenticated users to access or manipulate files outside permitted directories. Additionally, contributors and above could overwrite arbitrary posts; draft or pending post slugs and private parent post titles could be disclosed through attachment metadata due to missing authorization checks.
The XML-RPC interface, long a target for attackers for its remote publishing and administrative capabilities, has also been tightened. The patch stops using the XML-RPC API to publish customize_changeset posts without the required edit_css capability. And any authenticated user no longer has the power to reparent comments — change their structure — which was a concern in environments with multiple users and editorial workflows.
Support, Updates & Coverage
Seventeen bugs in WordPress Core and nineteen in the Block Editor were also addressed in the 7.1.1 release. Security patches are being back-ported to supported security branches, including versions back to 4.7, though only the latest version (7.1.1) continues to receive active full support. Users running WordPress with manual update settings can trigger the update via the Dashboard under the Updates section.
The vulnerabilities were discovered and responsibly disclosed by multiple researchers, including Rafie Muhammad, Jeremy Felt, Paulos Yibelo, Jesse McNeil, as well as teams such as pwn.ai, Anthropic, HDWSec, and others. Their findings cover a span of components and risk levels.
What this means is that WordPress websites — especially those with open comment sections, custom themes or XML-RPC enabled — are exposed until the patch is applied. Failure to update could allow attackers to inject harmful content, view private data, or manipulate site structure.
