September 2026 brought two important WordPress security releases in less than a week. WordPress 7.1.1 addressed 11 security issues on September 17, followed by WordPress 7.1.2 on September 22 with a fix for a critical vulnerability that could, under certain conditions, lead to remote code execution.

If your WordPress website has not been updated yet, we strongly recommend installing the latest available version as soon as possible. WordPress currently recommends updating to 7.1.2, or to the corresponding patched release if you are maintaining an older supported branch.

But if you can’t update immediately because of compatibility requirements, testing, or other technical constraints, HostArmada customers can consider activating Armada V-Shield for an additional layer of protection. Powered by Patchstack, Armada V-Shield monitors WordPress core, plugins, and themes for known vulnerabilities and can apply mitigation rules for supported vulnerabilities while you prepare to install the official update. It should not be treated as a replacement for keeping WordPress up to date.

Let’s have a look at the WordPress security vulnerabilities addressed during September 2026 and what website owners should do.

WordPress 7.1.1 Fixed 11 Security Issues

WordPress 7.1.1 was released on September 17, 2026 as both a maintenance and security update.

Alongside fixes for WordPress Core and the Block Editor, the release addressed 11 security issues covering cross-site scripting, access control, path traversal, information disclosure, and other areas of WordPress core.

Unauthenticated Stored Cross-Site Scripting in wpautop()

One of the more notable vulnerabilities affected wpautop(), a WordPress function responsible for automatically formatting content.

Under certain circumstances, an unauthenticated visitor could submit content that resulted in stored cross-site scripting (XSS). For comments, successful exploitation was subject to the comment being published, which means normal comment moderation could limit the attack but did not eliminate the vulnerability.

The issue has been assigned CVE-2026-93485 and received a CVSS 3.1 score of 7.1. It affected WordPress through version 7.1 and was fixed in WordPress 7.1.1. Patchstack also released mitigation protection for this vulnerability.

Other Security Issues Fixed in WordPress 7.1.1

The release addressed ten additional security issues, including:

• An HTML API issue involving set_modifiable_text() and HTML comment handling.
• Stored cross-site scripting affecting some themes that support custom headers.
• Specially crafted URLs that could cause an inactive theme from WordPress.org to be installed and previewed.
• A Multisite permissions issue involving network-only plugins.
• Authenticated path traversal in the WordPress REST Templates Controller.
• An XML-RPC permissions issue involving customize_changeset posts.
• An arbitrary post overwrite vulnerability available to Contributor-level users.
• Disclosure of private parent-post titles caused by a missing permission check.
• Disclosure of draft and pending post slugs to Contributor-level users.
• An authorization issue that allowed authenticated users to reparent comments, including notes.

Several of these vulnerabilities required an authenticated WordPress account or specific user privileges, while others depended on additional user interaction or configuration. Their individual impact therefore varied considerably.

Nevertheless, WordPress recommended that website owners install the security release immediately.

WordPress 7.1.2 Fixed a Critical Core Vulnerability

Only five days after WordPress 7.1.1 was released, another security update became necessary.

WordPress 7.1.2 was released on September 22, 2026 to address a critical vulnerability in WordPress core affecting page template resolution.

The vulnerability is tracked as CVE-2026-87902.

An unauthenticated attacker could, under certain conditions, manipulate page template resolution and cause WordPress to include a chosen readable local PHP file located outside the active theme directories.

If additional requirements involving the server environment and active theme were also present, the vulnerability could ultimately lead to remote code execution.

The vulnerability received a CVSS 4.0 score of 9.2 and affected WordPress versions from 4.7 through 7.1.1.

Exploitation Attempts Were Detected Quickly

The urgency surrounding CVE-2026-87902 increased shortly after the patch became public.

Patchstack reported seeing probing attempts against WordPress websites on September 22, less than five hours after WordPress 7.1.2 was published.

The activity observed at that point consisted of probes rather than successful payload delivery, but it demonstrated how quickly attackers can begin investigating a newly disclosed WordPress vulnerability after a security update becomes available.

Patchstack subsequently released a RapidMitigate rule designed to block exploitation attempts against protected websites.

Which WordPress Versions Should You Use?

For websites running the current WordPress branch, the recommended update is WordPress 7.1.2.

WordPress also released security backports for older eligible branches. For example, WordPress 7.0.6 was released alongside 7.1.2, with additional patched releases available for older branches. WordPress notes, however, that only the most recent version is actively supported.

Whenever possible, we therefore recommend running the latest stable WordPress release rather than remaining on an older branch solely because a security backport is available.

What Should WordPress Website Owners Do?

The first step is to check which version of WordPress your website is currently running.

You can do this from your WordPress Dashboard and install available updates from:

Dashboard > Updates > Update Now

Websites configured to receive automatic background security updates may already have received the appropriate patched version. Even so, it is worth checking your website manually to confirm that the update was successfully installed.

Before manually updating a production website, make sure you have a recent backup available, particularly if your site uses custom themes, plugins, or functionality that could be affected by a WordPress core update.

If you cannot update immediately because you need additional compatibility testing or must resolve another technical dependency first, additional vulnerability protection can help reduce your exposure during that period.

How Armada V-Shield Can Help Protect WordPress Websites

HostArmada customers can add another security layer with Armada V-Shield, powered by Patchstack.

Once activated, Armada V-Shield scans the WordPress environment for known vulnerabilities affecting WordPress core, themes, and plugins. Vulnerabilities can be viewed directly through the HostArmada Client Area.

Its protection modules include RapidMitigate WordPress, which can automatically apply mitigation rules for critical vulnerabilities, along with advanced hardening and malicious IP blocking.

That is particularly useful in situations where an official patch exists but cannot be installed immediately. For example, Patchstack released mitigation protection for both the unauthenticated stored XSS addressed by WordPress 7.1.1 and the critical CVE-2026-87902 vulnerability fixed in WordPress 7.1.2.

Virtual protection, however, should complement rather than replace software updates. Once an official WordPress security update is available and has been tested for your website, installing it remains the preferred way to resolve the underlying vulnerability.

HostArmada’s Approach to WordPress Security

WordPress security should never depend on a single protection mechanism.

HostArmada combines multiple security layers, including web application firewall protection, network firewall protection, malware scanning and removal, DDoS protection, account isolation, backups, and server-level security measures.

Armada V-Shield extends those protections to the WordPress application itself by detecting known vulnerabilities in WordPress core, plugins, and themes and providing targeted protection against supported threats.

September’s WordPress releases demonstrate why this layered approach matters.

WordPress 7.1.1 addressed 11 security issues, and only five days later WordPress 7.1.2 was required to resolve another critical vulnerability. Website owners may not always have advance notice of when the next vulnerability will be discovered, which makes regular updates, backups, monitoring, and additional security layers an important part of maintaining a WordPress website.

Keep Your WordPress Website Protected

Security vulnerabilities are sometimes discovered even in widely used and actively maintained platforms like WordPress. What matters is how quickly those vulnerabilities are addressed and how quickly website owners install the available fixes.

During September 2026 alone, WordPress released fixes addressing 12 security issues across WordPress 7.1.1 and 7.1.2. Some required authenticated access or specific conditions to exploit, while CVE-2026-87902 posed a much greater risk because an attacker did not need a WordPress account, and remote code execution could be possible when the necessary conditions were present.

The most important action remains straightforward: keep WordPress updated.

Check your WordPress installation and upgrade to WordPress 7.1.2 or the latest available patched version if you have not already done so.

If an immediate update is not practical, HostArmada customers can use Armada V-Shield as an additional layer of protection while preparing and testing the required update.