trydabble
All security updates

Patchpad / WordPress

How to check your WordPress version and update it

Last verified (KST)

WordPress shows its version in the admin screen, and most sites update themselves. This page helps you confirm that yours is on a fixed release.

WordPress sites: this time, PHP is what needs updating

On 21 October 2026, PHP released security fixes for PHP itself. WordPress.org says these issues are not specific to WordPress and “No WordPress update is required or planned for these issues”; site owners are encouraged to update PHP. Check your PHP version under Tools → Site Health → Info → Server, then compare it with the fixed versions on the PHP page.

Compare your version on the PHP pageWordPress.org notice (2026-10-21)Published

This page doesn't scan any site. It explains how to check your own.

What happened

On 6 October 2026, WordPress released 7.1.3, the newest version of the current 7.1 branch. It has 7 security fixes and 4 bug fixes. WordPress recommends updating because it is a security release; sites with automatic background updates start the update on their own. wordpress.org

Recent advisories

If your version starts with the number on the left, you need the one on the right or later.

AdvisoryRating (vendor)Fixed in
WordPress 7.1.3: security and maintenance release (October 2026)Vendor advisorywordpress.orgAlso: WordPress 7.0.7 version notes, WordPress 6.9.10 version notes, WordPress 6.8.11 version notes, WordPress releasesPublished2026-10-06Last verified2026-10-22 (KST)Rating (vendor)

See vendor page

WordPress: 7 security fixes and 4 bug fixes

Fixed in
  • 7.1:7.1.3or later
  • 7.0:7.0.7or later
  • 6.9:6.9.10or later
  • 6.8:6.8.11or later

7.0.7, 6.9.10 and 6.8.11 came out the same day with the same seven security fixes. WordPress also makes these fixes available on older affected branches, but only the most recent version is actively supported.

WordPress 7.1.2: one critical security fix (September 2026)CVE-2026-87902On 22 September 2026, WordPress released 7.1.2 to fix one critical issue: when certain server and theme conditions are met, someone who is not logged in could use page-template selection to run code on the server. The fix was backported to all branches back to 4.7.Vendor advisorywordpress.orgAlso: github.com, www.cve.orgPublished2026-09-22Last verified2026-10-22 (KST)Rating (vendor)

Critical

CVSS v4.0 9.2

Fixed in
  • 7.1:7.1.2or later
  • 7.0:7.0.6or later
  • 6.9:6.9.9or later
  • 6.8:6.8.10or later

Older branches got the fix too, from 6.7.9 back to 4.7.37. The October releases 7.1.3, 7.0.7, 6.9.10 and 6.8.11 include it as well.

WordPress 7.0.2: two core fixes (July 2026)CVE-2026-63030, CVE-2026-60137In July 2026, WordPress fixed two bugs in its core that, combined, could let an outsider take over a site. WordPress.org pushed the fix to affected sites through automatic updates. Versions before 6.8 were not affected.Vendor advisorywordpress.orgAlso: github.comPublished2026-07-17Last verified2026-10-22 (KST)Rating (vendor)

Critical

WordPress: one critical and one high severity issue

Fixed in
  • 7.0:7.0.2or later
  • 6.9:6.9.5or later
  • 6.8:6.8.6or later

6.8 only had the second bug (CVE-2026-60137). Versions before 6.8 were not affected.

WordPress 6.9.2 and 6.9.4 security releases (March 2026)A security release fixing several issues, including server-side request forgery, cross-site scripting and path traversal.Vendor advisorywordpress.orgAlso: WordPress 6.9.4 version notesPublished2026-03-10Last verified2026-10-22 (KST)Rating (vendor)

See vendor page

WordPress: “security release”

Fixed in
  • 6.9:6.9.4or later

Some fixes were not fully applied in 6.9.2 (10 March), so WordPress completed them in 6.9.4 on 11 March. Fixes for older branches ship as their own releases. The July and later fixed releases above include these fixes too.

How to check your version

Hosting panel

  • Managed hosting (WordPress.com and similar): the site overview in your host's panel shows the WordPress version.

Admin screen or project files

  • In your WordPress admin, open Dashboard → Updates. It says which version you have and whether a newer one exists.

  • Or open Tools → Site Health → Info → WordPress → Version. wordpress.org

Command line

How to update

Your host or platform runs it

  • Also update PHP. On 21 October 2026 WordPress.org said of the PHP security fixes: “No WordPress update is required or planned for these issues.” Update PHP instead: see your PHP version under Tools → Site Health → Info → Server and compare it on the PHP page. wordpress.org

  • Managed hosts usually update WordPress core for you. Confirm the version in their panel; if it is still older than a fixed release, ask them with the message below.

  • For the July 2026 fixes, WordPress.org turned on forced automatic updates for affected sites, so many sites have already updated themselves. wordpress.org

You run the server

  • In the admin, open Dashboard → Updates and choose Update Now. Back up first if you can.

  • With WP-CLI, update with this command. make.wordpress.org

    wp core update

  • As of 2026-10-06 the newest release is 7.1.3; older branches are on 7.0.7, 6.9.10 and 6.8.11. wordpress.org

If you can't update yet

WordPress 7.1.3: security and maintenance release (October 2026)

WordPress.org published no workaround; its advice is to update (7.1.3; older branches 7.0.7, 6.9.10 or 6.8.11). If you truly cannot update today, you can ask your host whether their firewall covers these issues. That is a question for your host, not WordPress guidance. wordpress.org

What to ask your host

Copy this, fill in the brackets and send it through your host's support channel.

Hello, my site [your domain] runs WordPress on your hosting. WordPress released security updates on October 6, 2026 (7.1.3, 7.0.7, 6.9.10 and 6.8.11). Could you confirm which WordPress version my site runs, whether automatic core updates are on, and that it is on a fixed release? Thank you.

Vendor sources

Last verified (KST)