13 Nov 2026, 12:00 pm

Reprint is a free, open-source, PHP-based tool that copies a WordPress site’s files and database. The plugin is available in the WordPress.org Plugin Directory, along with the command-line client used to copy the site.

WordPress has long let you export your posts and pages. Moving the site itself means bringing along its theme, plugins, uploads, and settings, too. Making that easier has been part of WordPress’s Data Liberation work since 2024.

Example use cases

You can use Reprint to copy your site to a new host, or to create a local copy meant for testing.

While moving your site to a new host, visitors can keep using the original. Use Reprint to copy the site, and then open the copy to check that your pages load, your images appear, and your forms work before you send visitors there. When you’re ready to switch, pause changes on the original site, make one last copy, and point your domain to the new host. The step-by-step guide to moving your site walks you through the move.

You can also use Reprint to create a site copy meant for testing, a place to try changes without affecting the site your visitors use. Copy your site to your computer or try the experimental, browser-based option in WordPress Playground. Use the copy to try a new layout with your existing pages, see how a plugin fits into your site, or check that everything still works after a WordPress update.

How Reprint copies a site

Reprint sends your files and database directly to the computer or server you choose, one piece at a time, without needing to connect to an external service. The transfer can begin without your old host having to make room for an archive of the whole site.

If the connection drops during the copy, you can resume from the last saved point. If you give Reprint a new site address, it can update links that point to the old one. It builds on the WordPress Importer’s approach to rewriting links and applies it to the copied database, including links stored in site settings, blocks, shortcodes, and complex data structures like serialized data or custom fields safely without corrupting tables.

When copying a site repeatedly, Reprint figures out what changed since the last time and copies only the files it needs.

Try Reprint

You don’t need to connect your own site to see how Reprint works. Try the experimental, browser-based option in WordPress Playground. You can copy a sample site right in your browser, with nothing to install.

When you’re ready to work with your own pages and settings, start with a test site you manage. The guide to making your first copy takes you from installing the plugin to opening the copied site on your computer.

11 Nov 2026, 2:00 pm

Next year, WordCamp Asia 2027 heads to Penang, Malaysia. From April 9 to 11, the WordPress community will gather at the Penang Waterfront Convention Centre for three days of contribution, learning, and connection. Tickets are on sale and sponsorship applications are open, so now is the time to make your plans.

In 2026, WordCamp Asia brought 2,627 attendees to Mumbai, India. More than 1,500 participants joined Contributor Day, where table leads guided work on more than 20 contribution tables. The conference days that followed covered topics ranging from AI and developer workflows to enterprise WordPress and journalism on the open web, and closed with a panel featuring WordPress Executive Director Mary Hubbard, Peter Wilson, and Sergey Biryukov.

WordPress is not a company. It is a shared commitment to keeping the web open.

Mary Hubbard, Executive Director, WordPress

The mix of hands-on work and big-picture conversation is what sets a WordCamp apart. You learn from the people who build, scale, and maintain WordPress every day, trade ideas in the hallway between sessions, and head home with new collaborators and fresh energy for the work ahead.

Penang offers a memorable setting for WC Asia. George Town, a short drive from the venue, is a UNESCO World Heritage Site, and National Geographic named Penang one of the best places in the world to travel to in 2027. The island is famous for its food, from internationally-recognized street food to fine dining, and it is one of Malaysia’s leading destinations for tourism. If you can, give yourself a day or two on either side of the conference to explore.

A regular ticket costs only USD $35, thanks to our sponsors. It covers both conference days, lunch and refreshments, and the after party. Tickets are released in batches, so buying early secures your place and helps organizers plan for everyone who is coming. Contributor Day on April 9 has its own registration, which opens January 27, 2027. It is limited to 600 participants.

Join Asia’s Largest WordPress Gathering

April 9 – 11, 2027 | Penang Waterfront Convention Centre (PWCC), Penang, Malaysia

Get Your Event Pass

None of this happens without sponsors. Their support keeps ticket prices low, backs the volunteers and contributors who make the event run, and helps WordCamp Asia stay true to the values of the WordPress project. In return, sponsors meet an engaged, international audience of developers, agencies, business owners, and creators.

Five packages are available, from a Small Business table to a Platinum booth, so there is a fit for local companies and global brands alike. Every sponsor also gets access to the Career Corner, a dedicated space for meeting and hiring WordPress professionals.

WordCamp Asia is organized by and for the community. Volunteers, organizers, speakers, sponsors, and attendees each shape what the event becomes, whether they are contributing for the first time or reconnecting with collaborators they have known for years.

However you choose to take part, your presence matters. Buy a ticket, bring a colleague, sponsor the event, or share this post with someone who should be there. Each of those choices strengthens WordPress and the people behind it.

See you in Penang.

10 Nov 2026, 4:59 pm

WordPress 7.2 Beta 5 is ready for download and testing!

This beta release is intended for testing and development only. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, use a test environment or local site to explore the new features.

How to Test WordPress 7.2 Beta 5

You can test WordPress 7.2 Beta 5 in any of the following ways:

The scheduled final release date for WordPress 7.2 is December 8, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who contributes by testing!

What’s in WordPress 7.2 Beta 5?

For technical details on the issues addressed since Beta 4, see the following links:

• Closed 7.2 WordPress Core Trac tickets since November 3, 2026
• 7.2 Gutenberg commits since November 3, 2026

Continued Improvements to WordPress 7.2

WordPress 7.2 Beta 5 continues refining the upcoming release with additional security, accessibility, and compatibility improvements.

Recent changes include email notifications when application passwords are created, improved keyboard navigation in the WordPress admin toolbar, and accessibility refinements to Visual History. Additional fixes strengthen permissions for Notes reactions, improve compatibility with MP3 uploads, and address automatic update behavior in Git worktree installations.

Learn more: Trac #63927, Trac #66331, Trac #65122, Trac #66447, Trac #46544, Trac #66460

Further Refinements to Ipsum

The new default theme, Ipsum, receives another round of improvements in WordPress 7.2 Beta 5. Accessibility enhancements include improved keyboard focus indicators and view transitions that respect reduced-motion preferences. Additional refinements to block styles and patterns provide greater design flexibility, while optimized stylesheets and other under-the-hood improvements help prepare the theme for its final release.

Learn more: Trac #66631, GitHub #198, GitHub #187, GitHub #180

PHP 8.6 Compatibility Improvements

WordPress 7.2 aims to fully support PHP 8.6, which is scheduled to be released on November 19, 2026. The WordPress project has a long history of being compatible with new versions of PHP as soon as possible, and this release is no different.

As of the Beta 5 release, all known compatibility issues with PHP 8.6 have been resolved.

While all of the known issues in WordPress have been addressed, you will need to verify that all of your plugins and themes are also compatible with PHP 8.6 prior to upgrading. Keep an eye on the Making WordPress Core blog in the coming days for more detailed information about what to look for.

WordPress continues to encourage all users to run the latest and greatest versions of PHP.

Learn more: Trac #66648

How important is your testing?

Testing for issues is a critical part of developing any software, and it’s a meaningful way for anyone to contribute – whether or not you have experience. Details on what to test in WordPress 7.2 are available here.

If you encounter an issue, please share it in the Alpha/Beta area of the support forums. If you are comfortable submitting a reproducible bug report, you can do so via WordPress Trac. You can also check your issue against this list of known bugs.

Curious about testing releases in general and how to get started? Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

A Beta 5 haiku

One last beta blooms
Release candidate awaits
The finish draws near

Props to @audrasjb and @desrosj for pre-publish review.

9 Nov 2026, 4:01 pm

More than 50 educational institutions have joined WordPress Credits, giving students worldwide a way to earn academic recognition for contributing to WordPress. The program had two participating institutions in September 2025 and four the following month. By June 2026, that number had reached 27, before passing 50 this October.

The program launched with the University of Pisa and was announced at WordCamp Europe 2025. Since then, it has expanded through partnerships that connect students with experienced contributors and practical projects. The WordPress Credits dashboard recorded participating institutions across 17 countries as of October 19, including Bangladesh, Costa Rica, Spain, Bolivia, and Indonesia. Each institution can adapt the program to its academic requirements, allowing students to contribute as part of their studies.

Learn through contribution

Students work with mentors on projects that reflect their interests and areas of study. They might translate WordPress, improve documentation, create learning materials, or contribute to development and testing. Alongside that work, they practice collaborating with others and responding to feedback, then present their contributions at the end of the program. By October 19, the dashboard recorded 364 graduates and student contributions across 18 WordPress teams. That work supports the software and resources people use throughout the WordPress community.

Help the program grow

Local contributors have helped establish these partnerships by introducing WordPress Credits to nearby schools and adapting it to local languages and educational settings. Mentors guide students through their first contributions, while sponsors provide support and resources. Educators help make that participation part of students’ academic work. Thank you to the students, educators, mentors, and supporters whose involvement has brought the program to more than 50 institutions.

Institutions can include WordPress Credits in an existing course, offer it as an internship, or incorporate it into a final project. The program is available at no cost to partner institutions, with flexible formats to suit their students and curriculum. To get started, read how to launch a WordPress Credits program and register your institution’s interest through the program page.

3 Nov 2026, 3:45 pm

WordPress 7.2 Beta 4 is ready for download and testing!

This beta release is intended for testing and development only. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, use a test environment or local site to explore the new features.

Wait, what happened to 7.2 Beta 3???

WordPress 7.1.4 was released on October 28 which included WordPress 7.2 Beta 3.

How to Test WordPress 7.2 Beta 4

You can test WordPress 7.2 Beta 4 in any of the following ways:

The scheduled final release date for WordPress 7.2 is December 8, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who contributes by testing!

What’s in WordPress 7.2 Beta 4?

For technical details on the issues addressed since Beta 2, see the following links:

• Closed 7.2 WordPress Core Trac tickets since October 27, 2026
• 7.2 Gutenberg commits since October 27, 2026

Continued Improvements to WordPress 7.2

WordPress 7.2 Beta 4 continues refining the upcoming release with improvements to accessibility, editor reliability, and developer APIs, alongside additional bug fixes and compatibility updates.

Recent work includes improved keyboard focus visibility in Windows High Contrast mode, refinements to administration interfaces, and fixes for right-to-left block alignment and custom block spacing.

Developers will also benefit from continued improvements to the Abilities API, DataViews extensibility, and REST API behavior. Additional fixes strengthen revision handling, input validation, and compatibility across supported environments.

Learn more: Trac #45910, Trac #66382, Trac #66427, Trac #66383, Trac #66343, Trac #66329

Continued Improvements to Ipsum

The new default theme, Ipsum, continues to receive refinements ahead of WordPress 7.2’s final release. Recent updates improve accessibility with clearer keyboard focus indicators, more descriptive screen reader links, and better support for right-to-left languages. Additional improvements refine block patterns, touch target spacing, and color palette compatibility with other default themes.

Learn more: Trac #66352, GitHub #15113

Improved Translation Update Management

WordPress 7.2 makes managing translation updates easier by displaying individual available updates on the Updates screen. Administrators can now review and selectively install translation updates, bringing language management in line with the familiar plugin and theme update experience.

Learn more: Trac #42281, GitHub #11610

How important is your testing?

Testing for issues is a critical part of developing any software, and it’s a meaningful way for anyone to contribute – whether or not you have experience. Details on what to test in WordPress 7.2 are available here.

If you encounter an issue, please share it in the Alpha/Beta area of the support forums. If you are comfortable submitting a reproducible bug report, you can do so via WordPress Trac. You can also check your issue against this list of known bugs.

Curious about testing releases in general and how to get started? Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

A Beta 4 haiku

Where did Beta Three go?
A surprise along the way
Four arrives on cue.

Props to @audrasjb, @courane01, @huzaifaalmesbah for pre-publish review.

28 Oct 2026, 5:13 pm

This security release features fixes for multiple issues.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.4 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.
WordPress 7.1.4 is a short-cycle release. The next major release will be version 7.2, currently planned for December 8th.

For more information, please visit the WordPress 7.1.4 HelpHub site.

Security updates included in this release

The security team would like to thank the following people and organizations for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

• A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window, reported by Umut Bayram.
• A stored XSS with specially crafted block markup, reported by Rafie Muhammad (Awesome Motive, Inc.).
• Privacy Data Removal Requests can be created in a way that leads to stored XSS, reported by Anthropic.
• Multiple stored XSS issues in the Interactivity API independently discovered by AnC and DatNLQ from VietSunshine Cyber Security, rekter0 and Anas cherni, Marcel Karlsson (whoismarcel), and Weston Ruter, Jon Surrell, Alex Concha, and Luis Herranz of the WordPress Security Team.
• A stored denial of service issue in the Interactivity API, reported by Jon Surrell of the WordPress Security Team.
• A stored XSS in Customizer selective refresh, reported by Rafie Muhammad (Awesome Motive, Inc.).
• A Stored XSS in the Categories block reported by Ben Bidner of the WordPress Security Team.
• Specially crafted User Logins can lead to a stored XSS reported by Anthropic.
• Unpublished customizer changesets can be discovered by unauthenticated users, reported by Antonio Lorensius Silaban.
• A Stored XSS in Playlist and image blocks, reported by Ben Bidner of the WordPress Security Team.
• Stored XSS in core/comments-pagination-next and core/comments-pagination-previous blocks, reported by Alex Concha of the WordPress Security Team.
• Notes can be read by privileged users that lack access to edit the post the note is attached to, reported by Ramon of the WordPress Security Team.
• An update to the bundled root certificates due to the eMudhra revocation.

Thank you to these WordPress contributors

This release was led by Aaron Jorbin and Nik Tsekouras. WordPress 7.1.4 would not have been possible without the contributions of the following people:

Aaron Jorbin, Adam Silverstein, Alex Concha, Andrew Duthie, Andrew Serong, David Arenas, Dennis Snell, Ella Van Durpe, George Mamadashvili, Isabel Brison, Jake Spurlock, Jb Audras, Jeremy Felt, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Kira Song,Lance Willett, luisherranz, Marco Ciampini, marcs0h, Marin Atanasov, Mario Santos, Miguel Fonseca, Nik Tsekouras, Peter Wilson, ramonopoly, Rudy Faile, Sergey Biryukov, umut3806, Weston Ruter

Backports

As a courtesy, the security fixes were backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

WordPress 7.2 Beta 3 has also been released, containing all applicable fixes.

27 Oct 2026, 3:49 pm

WordPress 7.2 Beta 2 is ready for download and testing! 

This beta release is intended for testing and development only. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, use a test environment or local site to explore the new features.

How to Test WordPress 7.2 Beta 2

You can test WordPress 7.2 Beta 2 in any of the following ways:

The scheduled final release date for WordPress 7.2 is December 8, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who contributes by testing!

What’s in WordPress 7.2 Beta 2?

For technical details on the issues addressed since Beta 1, see the following links:

• Closed 7.2 WordPress Core Trac tickets since October 20, 2026
• 7.2 Gutenberg commits since October 20, 2026

Continued Improvements to WordPress 7.2

WordPress 7.2 Beta 2 builds on the first beta with additional enhancements, bug fixes, and refinements across the administration experience and developer APIs.

Development continues on the Abilities API, including content querying, capability requirements, and improvements to schema handling and permissions. New server-side registration capabilities for DataViews and DataForm also provide developers with more ways to extend WordPress interfaces.

Additional work includes improvements to REST API flexibility, admin asset loading, and the transition to modern SVG icons throughout WordPress administration.

Learn more: Trac #66268, Trac #66325, Trac #66229, Trac #66343, Trac #57548, Trac #65089

How important is your testing?

Testing for issues is a critical part of developing any software, and it’s a meaningful way for anyone to contribute – whether or not you have experience. Details on what to test in WordPress 7.2 are available here.

If you encounter an issue, please share it in the Alpha/Beta area of the support forums. If you are comfortable submitting a reproducible bug report, you can do so via WordPress Trac. You can also check your issue against this list of known bugs.

Curious about testing releases in general and how to get started? Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

A Beta 2 haiku

Second beta takes shape
New abilities take root
WordPress grows stronger

Props to @mamaduka for pre-publish review.

21 Oct 2026, 1:44 pm

The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP.

Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place to mitigate the vulnerabilities, but you should still check for updates from your web host and, if necessary, update PHP as soon as possible.

Within WordPress, you can see which version of PHP your site runs under Tools > Site Health > Info > Server. Many web hosts provide this information in your web hosting administration panel too.

These vulnerabilities are not specific to WordPress and affect any server that hosts a PHP application. No WordPress update is required or planned for these issues.

Versions of PHP prior to 8.2 no longer receive security updates from the PHP project.

If your site runs a version prior to this and you manage your own web hosting, you should consider taking your server offline while you prepare to update to a newer version of PHP. This advice is being published by several national cyber security agencies. To quote the UK National Cyber Security Centre:

Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.

Further information on wordpress.org:

• Get a faster, more secure website: update PHP today
• PHP Compatibility and WordPress Versions
• FAQ My site was hacked

20 Oct 2026, 4:02 pm

This beta release is intended for testing and development only. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, use a test environment or local site to explore the new features.

How to Test WordPress 7.2 Beta 1

You can test WordPress 7.2 Beta 1 in any of the following ways:

The scheduled final release date for WordPress 7.2 is December 8, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who contributes by testing!

Editing Experience

Responsive Design Controls

Building on the responsive design improvements introduced in WordPress 7.1, WordPress 7.2 expands viewport-specific styling to additional design tools and blocks. Creators gain more granular control over how layouts and visual settings adapt across screen sizes, including responsive Gallery settings for columns, image cropping, and aspect ratios.

Learn more: GitHub #80388, #82003

Improved Global Styles and Design Tools

WordPress 7.2 makes site-wide styling easier to manage with a new Customized filter for finding blocks with modified styles and inherited Global Styles values displayed directly in block inspector controls. Expanded design tools and support for styling form elements provide additional flexibility when creating a consistent visual identity across a site.

Learn more: GitHub #82520, #76525, #34198, #84657

Text Shadow Support

WordPress 7.2 introduces new text shadow controls, giving creators more ways to add depth and emphasis to their content. Text shadows can be customized through block settings and defined as presets in theme.json, making it easier to maintain consistent typography across a site.

Learn more: GitHub #73320, GitHub #79584, Trac #65869

Easier Navigation Management

Improvements to the Site Editor make managing navigation links more intuitive. Creators can add, organize, and edit navigation items directly from the editor sidebar, making it easier to maintain site menus without interrupting their editing workflow.

Learn more: GitHub #77069

Better Collaboration with Notes

WordPress 7.2 introduces Emoji reactions on notes and a new toolbar icon that makes Notes easier to access and manage. Notes move to the editor canvas, bringing conversations directly into the margin. Users can now keep Notes and the block settings sidebar open simultaneously, making it easier to review feedback while editing content.

A new minimized Notes mode reduces visual clutter, while improvements to positioning and display create a smoother, more consistent collaboration experience.

Learn more: GitHub #79970, GitHub #83786, GitHub #80015, Trac #64638

Faster, More Efficient Media Uploads

WordPress 7.2 expands client-side media processing to the Media Library, allowing images to be resized, compressed, and converted directly in the browser before being uploaded. This can improve upload performance, reduce server resource usage, and provide better support for modern image formats, particularly on hosting environments with limited image-processing capabilities.

Learn more: Trac #65661, GitHub #12585

New “On This Day” Dashboard Widget

WordPress 7.2 introduces a new On This Day dashboard widget that helps users rediscover content published on the same date in previous years. By highlighting posts from the site’s history, the widget makes it easier to revisit past content, celebrate milestones, and find opportunities to refresh or reshare older posts.

Learn more: Trac #65116

Block Editor Usability Improvements

WordPress 7.2 includes a collection of smaller improvements aimed at reducing friction in everyday editing. These changes include clearer error messages, more helpful feedback when something goes wrong, and refinements to common editor interactions, making the editing experience more predictable and approachable.

Learn more: GitHub #81453, #82496, #84656, #84649

A More Consistent WordPress Admin

WordPress 7.2 continues modernizing the administration experience by replacing legacy Dashicons in the admin bar and sidebar with icons from the WordPress icon library. The updated icons bring greater visual consistency between the traditional WordPress dashboard and newer editing interfaces.

Learn more: GitHub #12270

An Updated Block Settings Experience

A new DataForm-powered inspector introduces a refreshed approach to managing block settings in the editor. Built on the DataForm component system, this work aims to provide more consistent controls and a more extensible foundation for future block editing improvements.

Learn more: GitHub Gutenberg · Call for Testing

Faster WordPress Administration

WordPress 7.2 improves admin performance by modernizing how scripts and stylesheets are loaded. Instead of combining assets into large files, WordPress now loads them individually for better browser caching. A new prefetching mechanism also anticipates which admin screen users are likely to visit next, loading its resources in advance to make navigation between the dashboard, post lists, and editor faster.

Learn more: Trac #57548

For Developers

New Secrets API

WordPress 7.2 introduces a Secrets API, providing developers with a standardized, secure way to store sensitive credentials such as API keys and authentication tokens. The API supports encryption at rest, credential rotation, and customizable storage providers, helping plugins and integrations manage sensitive information more securely.

Learn more (Trac #66187)

Random Content Redirects

WordPress 7.2 adds support for random content redirects, allowing visitors to discover a randomly selected post through a dedicated URL. This provides a simple way to encourage content exploration and help readers rediscover older posts.

Learn more: Trac #64498

More Powerful APIs for Developers

WordPress 7.2 expands the Abilities API with new capabilities for accessing and querying WordPress data, providing a more consistent foundation for integrations, automation, and AI-powered tools. (Trac #66268, #64605, #64657)

Enhancements to the Interactivity API introduce new ways to render trusted HTML and manage reactive navigation, giving developers more flexibility when building dynamic, interactive blocks. (Trac #66246, Gutenberg PR #83092)

Additional improvements to the HTML API, block supports, and responsive design tools provide more reliable markup processing and greater control over how custom blocks are styled and displayed across devices. (Trac #65824, #66150, #65869)

How important is your testing?

Testing for issues is a critical part of developing any software, and it’s a meaningful way for anyone to contribute – whether or not you have experience. Details on what to test in WordPress 7.2 are available here.

If you encounter an issue, please share it in the Alpha/Beta area of the support forums. If you are comfortable submitting a reproducible bug report, you can do so via WordPress Trac. You can also check your issue against this list of known bugs.

Curious about testing releases in general and how to get started? Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

WordPress 7.2 will include new features that were previously only available in the Gutenberg plugin. Learn more about Gutenberg updates since WordPress 7.1 in the What’s New in Gutenberg posts for versions 23.7, 23.8, 23.9, 24.0, 24.1, 24.2, and 24.3.

What’s new in WordPress 7.2?

With so much in progress for WordPress 7.2 Beta 1, this is still only the beginning; expect continued refinement with each Beta and RC release ahead of the final release on December 8, 2026

Just for you: a Beta 1 haiku:

Ipsum takes the stage
Secrets bloom, designs take shape
New blocks come alive

Props to @audrasjb, @annezazu, @adamsilverstein, @westonruter, @markoserb, @im3dabasia1, @jorbin, and @noruzzaman for proofreading and review.

6 Oct 2026, 5:00 pm

This security and maintenance release features 7 security fixes and 4 bug fixes.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

Security updates included in this release

The security team would like to thank the following people and organizations for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

• A stored XSS on the Comments administration page, exploitable via pending comments, reported by Trail of Bits in collaboration with OpenAI.
• A DoS issue in the WP_Http::make_absolute_url() method, reported by Anthropic
• A second-Order SQL injection in WordPress WXR export, reported by Anthropic
• A weakness allowing Author role users to sticky posts, reported by Anthropic
• Unauthenticated disclosure of comments on private & unpublished posts, reported by Ananda Dhakal from Patchstack
• Imgur embeds are vulnerable to XSS, reported by Zhengyu Liu, Jingcheng Yang, and Gavin Zhong
• Forgeable parameters passed to the {status}_{type} hook can lead to action name collision, reported by Alex Concha of the WordPress security team

Thank you to these WordPress contributors

This release was led by Jake Spurlock.

WordPress 7.1.3 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community.

Aaron Jorbin, Adam Silverstein, Adi Moldovan, Adrian Duffell, Alex Concha, Arkaprabha Chowdhury, Deepak Kumar, donniam, Ehtisham Siddiqui, Jake Spurlock, Jb Audras, Jeremy Felt, Joe Dolson, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Ken Gagne, Khokan Sardar, Lance Willett, lucatume, marcs0h, Peter Wilson, Paul Kevan, RS Software, Rudy Faile, Sergey Biryukov, siliconforks, smerriman, Stephen Bernhardt, Suryakant Upadhyay, vortfu, webVerts, Weston Ruter, Yogesh Bhutkar

Backports

As a courtesy, the security fixes are being backported, where necessary, to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

How to contribute

To get involved in WordPress core development, head over to Trac, pick a ticket, and join the conversation in the #core channel. Need help? Check out the Core Contributor Handbook.