WordPress has released version 7.1.1, a maintenance and security update that addresses 11 vulnerabilities affecting core platform components, themes, REST API functionality, comments, XML-RPC, and plugin management.
Site administrators are strongly urged to update immediately due to the potential impacts of stored cross-site scripting, authenticated path traversal, authorization bypasses, and information disclosure flaws.
This release also includes 17 core bug fixes and 19 fixes for the Block Editor. While WordPress 7.1.1 is a short-cycle maintenance release, WordPress 7.2 is expected to arrive in December.
One of the most notable issues addressed is a stored cross-site scripting (XSS) vulnerability in the wpautop() function. This flaw could allow an unauthenticated visitor to inject malicious script content through comments, provided that a site moderator subsequently approves the submitted comment.
Stored XSS vulnerabilities can be especially dangerous for WordPress sites because malicious JavaScript may execute in the browsers of administrators, editors, or visitors viewing the affected content.
Depending on the targeted user’s privileges, successful exploitation could lead to session theft, unauthorized administrative actions, content manipulation, or redirects to attacker-controlled pages.
The update also addresses a stored XSS vulnerability affecting certain themes that support custom headers. WordPress also fixed an HTML API issue where the set_modifiable_text() function could allow an attacker to escape an HTML comment through abrupt-closing sequences.
Another issue involved specially crafted URLs that could automatically install and preview an inactive theme from WordPress.org. Although the advisory did not disclose full exploitation details, the fix eliminates an unexpected theme-management pathway that could be exploited in targeted attacks.
WordPress 7.1.1 resolves an authenticated path traversal vulnerability in the WP REST Templates Controller, which Anthropic reported. Path traversal weaknesses can enable attackers to manipulate file paths using sequences like ../, potentially gaining access to unintended files or directories when application controls are insufficient.
Anthropic also reported a flaw that lets lower-privileged authenticated users overwrite posts outside their intended authorization scope, posing a risk to editorial integrity on multi-author websites.
Other authorization-related fixes include a vulnerability that allowed XML-RPC requests to publish customize_changeset posts while bypassing checks for the edit_css capability. WordPress has also fixed an issue that allowed site administrators to network-activate an installed network-only plugin.
The update fixes a missing read_post permission check in the attachment_submitbox_metadata() function. This flaw could expose the title of a private parent post through attachment metadata.
Additionally, WordPress addressed a missing authorization check that could disclose draft or pending post slugs to users with Contributor-level privileges and above. While these post slugs may seem low-risk, they can reveal planned articles, campaign names, product announcements, or sensitive editorial information.
Separately, an issue allowed any authenticated user to reparent comments, including internal notes. This could impact moderation workflows and potentially expose or misplace discussion context.
Administrators can download WordPress 7.1.1 from WordPress.org or install it through the dashboard by navigating to Updates and selecting “Update Now.” Sites configured for automatic background updates should receive the patch automatically.
WordPress has stated that security fixes are also being backported to supported legacy branches through version 4.7, where necessary. Site owners should verify their deployed version, review administrative accounts, and ensure that plugins and themes are updated alongside the core installation.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…