WordPress shipped version 7.1.1 on September 17, 2026, a maintenance and security release fixing 11 security issues alongside 17 core bug fixes. The headline flaw is CVE-2026-93485, an unauthenticated stored cross-site scripting vulnerability in wpautop(), the function that turns plain line breaks into paragraph tags across nearly every piece of content WordPress renders. It affects every WordPress version back through 4.7, and it’s fixed in 7.1.1.
What the wpautop() Flaw Actually Does
According to the official 7.1.1 release announcement, reported by Rafie Muhammad and carrying a CVSS 3.1 score of 7.1, the bug sits in how wpautop() handles quoted attribute values using regular expressions. A crafted comment can place a > character inside a quoted attribute in a way the function misreads as the end of a tag, which lets an attacker close out markup early and inject a working script. Because wpautop() runs on comment content by default, that script gets stored and then executes for anyone who loads the page where the comment displays.
The catch that keeps this from being a pure drive-by attack: the comment has to actually publish first. On a default install with comment moderation on, that’s a real barrier. It’s a much thinner one than it sounds, though, since WordPress auto-approves comments from anyone with a prior approved comment on the site, which is also the default. A single approved comment from a normal visitor is enough to get the door open for every comment after it.
The Other Ten Fixes
The rest of the release is lower-severity access control and disclosure issues rather than anything unauthenticated: a Contributor-level path to overwriting other posts, a REST API path traversal bug in the Templates Controller, an XML-RPC bypass around edit_css checks, private post-title leakage through attachment metadata, draft and pending post slugs disclosed without proper authorization, and any authenticated user being able to reparent comments. None of these need public exploit code circulating to be worth patching, but none of them are the reason to update today either. The wpautop() bug is.
What to Do About It
Update to 7.1.1. WordPress.org lists the usual three paths: the Dashboard’s Updates screen, a direct download, or automatic background updates if your site has them enabled for minor releases, which most managed hosts do by default. Security fixes are backported all the way to 4.7, so even a site running an old, unsupported major version has a patched release available.
Worth a five-minute check regardless of hosting setup: confirm comment moderation is actually on for public-facing content, and take a look at whether “automatically approve comments from users with a previously approved comment” makes sense for your site or is quietly working against you. It’s the default for a reason, but it’s also exactly the setting this specific bug leans on.
This is the same category of release ConicPlex covered when WordPress.org rolled out automated review for plugin updates earlier this month, just on the core side instead of the plugin ecosystem: a real, unauthenticated vulnerability sitting in code every WordPress site runs, fixed quietly in a point release most people will never read the changelog for. Ongoing WordPress development and maintenance work is what catches this kind of update the day it ships instead of whenever someone happens to notice the dashboard nag.
Sources
- WordPress 7.1.1 Maintenance and Security Release (WordPress.org News)
- WordPress 7.1.1 Maintenance and Security Release (Patchstack)
