WordPress 7.1.1 shipped on 17 September 2026 as a maintenance and security release. It includes 11 security fixes. The one most people will hear about first is a stored cross-site scripting issue in wpautop() — the function that turns line breaks into paragraphs on almost every WordPress site.
An unauthenticated visitor can carry a script payload in a comment. On a default install, comment moderation is often off, and the “must have a previously approved comment” gate can be bypassed. Patchstack has tracked this as CVE-2026-93485 and rates it high. WordPress recommends updating immediately.
This is core, not a plugin. That matters because plugin scanners alone will not tell you the story. You need the WordPress version itself on every site you manage.
What to do this morning
- Confirm the version on every WordPress site. Dashboard → Updates, or check the version remotely if you have a fleet tool. You want 7.1.1 on the 7.1 branch, or the matching security backport for older supported branches. WordPress is backporting the security fixes where needed; only the latest major is actively supported for everything else.
- Do not assume auto-updates covered the fleet. Many managed or pinned installs disable background updates. Verify rather than hope.
- Review comments waiting for approval. After you patch, clear or moderate anything still in the queue so an old payload does not sit ready to display.
- Back up before you bulk-update. A database and file backup that lands in Google Drive or Dropbox gives you an off-server restore if something fails mid-run.
- Prefer tracked updates. When you run the same security release across dozens of sites, you want a clear record of what queued, what succeeded, what failed, and what you retried.
Where CMS Inspect fits
CMS Inspect is the operations layer we built at Revibe Digital for WordPress and Joomla fleets. Free core gets you started. Advanced ops are $1 per active site per month.
For a release like 7.1.1, the useful pieces are:
- Safer update execution — queue, run, and retry updates with clearer state and an audit trail.
- Cloud backups — database and site files uploaded to Google Drive or Dropbox before you touch production.
- Uptime and incident context — so you notice quickly if a site misbehaves after the update.
- Security triage and client-ready reports — when you need to show a client what changed.
You can manage WordPress and Joomla in one dashboard. That helps when the same week also brings extension CVEs on the Joomla side and you do not want two separate ops habits.
A short checklist you can reuse
- ☐ Every WordPress site is on 7.1.1 or the correct backport
- ☐ Auto-update status verified (not assumed)
- ☐ Pending comments reviewed
- ☐ Off-server DB/file backup taken
- ☐ Update run logged (who, when, result)
- ☐ Quick uptime check after the batch
Security releases are normal. The risky part is the site you forgot. A fleet dashboard and a restore copy outside the server turn “I think we patched” into “we know we patched.”
Start free at cmsinspect.com.
