WordPress 7.1.1 Addresses 11 Vulnerabilities Across Core Features
WordPress has released version 7.1.1, a security and maintenance update addressing 11 vulnerabilities across core functionality, including stored XSS, path traversal, authorization bypasses and information disclosure.
The release also contains 17 Core bug fixes and 21 Block Editor fixes. WordPress recommends updating immediately because several issues affect content management and privileged operations.
Comment Handling Opens an XSS Route
One of the more notable issues affects thewpautop()function.
An unauthenticated visitor could submit malicious content through a comment that becomes executable JavaScript if a moderator later approves it. Another stored XSS issue affects custom header functionality in certain themes.
WordPress also corrected an HTML API problem involvingset_modifiable_text(), where specially crafted closing sequences could escape an HTML comment.
Theme Installation Gets Tighter Controls
The release also blocks specially crafted URLs from automatically installing and previewing inactive themes from WordPress.org.
A separate multisite issue allowed a site administrator to network-activate a plugin intended to be restricted to network-only activation.
REST API and XML-RPC Receive Important Changes
Anthropic reported an authenticated path traversal vulnerability in the WP REST Templates Controller.
The flaw could allow an authenticated attacker to manipulate file paths and potentially access locations outside the intended directory.
Another Anthropic-reported issue allowed users with Contributor-level privileges or higher to overwrite posts outside their authorized scope.
WordPress also addressed an XML-RPC weakness that could allowcustomize_changesetposts to bypass theedit_csscapability check.
Lower-Privilege Accounts Could Expose Editorial Data
Several fixes target authorization boundaries.
A missingread_postcheck could reveal the title of a private parent post through attachment metadata. Another authorization issue exposed draft or pending post slugs to Contributor-level users and above.
WordPress also fixed a flaw allowing authenticated users to reparent comments, including internal notes, potentially disrupting moderation workflows.
Older Branches Also Receive the Patches
The vulnerabilities are not limited to the latest branch. WordPress has backported the necessary fixes to supported older versions, with security updates reaching branches as far back as 4.7.
For example, WordPress 7.0 is covered by all 11 fixes, while versions 6.6 through 4.7 are affected by between six and 10 of the vulnerabilities. Versions 4.6 and older no longer receive security updates.
Update Through the Dashboard
Administrators can install 7.1.1 from Dashboard => Updates => Update Now, or rely on automatic background updates where enabled.
Because the release addresses multiple authorization and injection weaknesses, administrators should verify that production sites have moved to a patched branch and should update themes and plugins alongside Core. WordPress says version 7.1.1 is a short-cycle release, with version 7.2 currently planned for December.