WordPress 7.1.1 is available, and installing it should be a priority. Released September 17, 2026, it includes 11 security fixes, 17 core bug fixes and 19 block-editor fixes. This updates WordPress itself, not a plugin. Official announcement.
Checked September 19, 2026. This guide separates patching, verification and investigating a possible incident.
What is the actual security scope?
Fixes include XSS, permission issues and crafted links capable of installing and previewing an inactive theme. Prerequisites differ between flaws. The announcement provides no compromised-site count: being outdated does not prove your site was hacked.
There are two separate operational questions: “Am I missing the patch?” and “Are there unauthorized changes?” Version checks answer the first; evidence review answers the second. A site can need an update without being compromised, or remain compromised after an update.
Check what is installed
Open Dashboard → Updates and record the version. Do not rely on the public page's appearance: a cached response does not identify the core running on the server. If you manage multiple sites, track each domain, version, owner and verification result.
| Situation | Next step |
|---|---|
| WordPress 7.1 with an update pending | Back up and install the patched release |
| Already running 7.1.1 | Check key workflows and review plugins separately |
| Much older installation | Plan compatibility with PHP, the theme and extensions before upgrading |
| Unknown users or unexpected changes | Investigate a possible incident; an update alone is insufficient |
Update with your business workflows in mind
The basic WordPress procedure is to back up and select “Update Now” in the dashboard, then clear caches. Our operational checklist adds specific checks:
- Preserve both files and the database. Confirm the backup is accessible and does not depend solely on the same website.
- Define a test before starting. For a store: product page, cart, checkout and email. For a service website: form submission, message delivery and administrative login.
- Use staging for critical operations. Disable live payments and automated outgoing messages on that copy. Do not leave production exposed indefinitely while pursuing exhaustive testing.
- Update and verify the final version. Record the time, owner and result; a disappearing notice is not a substitute for checking.
- Repeat the agreed test. Check both a signed-in session and an anonymous visit.
Verification with WP-CLI
If you already use WP-CLI, run these checks from the correct directory as the site's operating-system user. The block's first line is the language label, not a command to copy.
wp core version
wp core check-update
A solid foundation for your WordPress site
Explore our WordPress hosting and choose a plan that fits your website, traffic and backup requirements.
After taking a backup, the following command installs the latest available release, which may no longer be 7.1.1 when you read this. Review the proposed version jump first. Update command documentation.
wp core update
wp core version
wp core verify-checksums
Checksum verification compares core files with their official counterparts. A successful check does not certify plugins, the database or the absence of intrusion. If verification fails, check the expected version and locale before concluding that malware is present. We have not run these commands on your server.
If something breaks or looks suspicious
Keep the exact error and review logs with your provider. Do not change permissions wholesale or reinstall everything just to silence an alert. If you find unknown administrators or unexpected modifications, preserve evidence, restrict access and request a security review.
On a store, restoring an entire database may erase orders placed after the backup. Before rolling back, distinguish file problems from data problems and coordinate recovery. A planned intervention is preferable to a rushed rollback.
Does updating WordPress also fix my plugins?
No. They are separate components. Review their updates and compatibility independently; a new core release should not be assumed to fix an extension's vulnerability.
Our recommendation: prioritize the patch, document a short functional test and keep its results. If you need hosting, explore TERAMONT hosting for WordPress and confirm which backups and maintenance tasks your plan includes. Hosting does not replace updates or guarantee a clean site.
