# WordPress security today

> Core and PHP security releases, which versions still get fixes, and what to update first. Checked every day.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 01:29 UTC.

## Update now

- Latest WordPress: 7.1.4
- 2026-10-28: [WordPress 7.1.4](https://wordpress.org/news/2026/10/wordpress-7-1-4/)
- 2026-10-21: [Critical PHP Security Release](https://wordpress.org/news/2026/10/critical-php-security-release/)
- 2026-10-06: [WordPress 7.1.3 Maintenance and Security Release](https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/)
- 2026-09-22: [WordPress 7.1.2 Release](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/)
- 2026-09-17: [WordPress 7.1.1 Maintenance and Security Release](https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/)

## What to do (from the changelog)

- 2026-11-02: HTTP2Shell: critical Brotli flaw reachable through WordPress. Ask the host whether the Brotli decoder serving the site is patched for CVE-2026-111497 and the services were restarted after the update (on a VPS, update the system packages, then restart). Blocking unauthenticated XML-RPC pingbacks removes only the route shown in the public exploit and may break integrations; the xmlrpc_enabled filter and the Settings > Discussion option do not block them. (https://www.wordfence.com/blog/2026/11/http2shell-wordpress-brotli/)
- 2026-10-29: Core Security Initiative: security releases now come often. Keep automatic minor (security) updates on, and expect more security releases: apply each one quickly rather than batching updates. (https://make.wordpress.org/security/2026/10/29/the-core-security-initiative-two-months-in/)
- 2026-10-28: WordPress 7.1.4 security release. Update to WordPress 7.1.4 now; fixes are being backported to older branches down to 4.7. (https://wordpress.org/news/2026/10/wordpress-7-1-4/)
- 2026-10-21: Critical PHP security release. Update PHP on every server now and move sites off PHP 8.1 or older (check Tools → Site Health → Info → Server). (https://wordpress.org/news/2026/10/critical-php-security-release/)
- 2026-10-16: MCP Adapter 0.7.1 and 0.6.2 security fixes. Update to MCP Adapter 0.7.1 (or 0.6.2 for Composer users on 0.6.x) and stop matching on `ability_not_public_mcp`. (https://github.com/WordPress/mcp-adapter/releases/tag/v0.7.1)
- 2026-10-06: WordPress 7.1.3 security and maintenance release. Update to WordPress 7.1.3 or later (7.1.4 is current). (https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/)

## Plugin vulnerabilities

46749 on record (oldest 2005-10-03), across 18837 plugins and themes, 3053 critical. Latest critical and high:

- 2026-11-04 HIGH: give (https://todaywp.com/plugins/give), Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter, up to 4.19.1. CVE-2026-118193, https://www.wordfence.com/threat-intel/vulnerabilities/id/f2ab1544-2428-4c93-b973-8280ff7a2903?source=api-prod
- 2026-11-04 HIGH: litespeed-cache (https://todaywp.com/plugins/litespeed-cache), Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching, up to 7.9.1. CVE-2026-93389, https://www.wordfence.com/threat-intel/vulnerabilities/id/4a66498d-7cf0-4480-b946-94e38f8fd350?source=api-prod
- 2026-11-04 HIGH: motors-car-dealership-classified-listings (https://todaywp.com/plugins/motors-car-dealership-classified-listings), Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter, up to 1.4.128. CVE-2026-116617, https://www.wordfence.com/threat-intel/vulnerabilities/id/9760bf39-6ec3-416e-95f0-3b3ce3ecdf7f?source=api-prod
- 2026-11-04 HIGH: miniorange-saml-20-single-sign-on (https://todaywp.com/plugins/miniorange-saml-20-single-sign-on), Allocation of Resources Without Limits or Throttling, up to 6.1.0. CVE-2026-62126, https://patchstack.com/database/wordpress/plugin/miniorange-saml-20-single-sign-on/vulnerability/wordpress-saml-sp-single-sign-on-plugin-6-1-0-denial-of-service-attack-vulnerability?_s_id=cve
- 2026-11-04 HIGH: doofinder-for-woocommerce (https://todaywp.com/plugins/doofinder-for-woocommerce), Insertion of Sensitive Information into Externally-Accessible File or Directory, up to 2.17.2. CVE-2026-56065, https://patchstack.com/database/wordpress/plugin/doofinder-for-woocommerce/vulnerability/wordpress-doofinder-for-woocommerce-plugin-2-17-2-sensitive-data-exposure-vulnerability?_s_id=cve
- 2026-11-04 HIGH: wc-multivendor-marketplace (https://todaywp.com/plugins/wc-multivendor-marketplace), Missing Authorization, up to 3.8.2. CVE-2026-62000, https://patchstack.com/database/wordpress/plugin/wc-multivendor-marketplace/vulnerability/wordpress-wcfm-marketplace-plugin-3-8-2-broken-access-control-vulnerability?_s_id=cve
- 2026-11-04 HIGH: gtm-server-side (https://todaywp.com/plugins/gtm-server-side), Server-Side Request Forgery, before 2.3.11. CVE-2026-118422, https://wpscan.com/vulnerability/e41ab896-23b8-40b3-8e3f-506d6cc5b85c/
- 2026-11-04 HIGH: newsletter-optin-box (https://todaywp.com/plugins/newsletter-optin-box), Cross-site Scripting, up to 4.4.2. CVE-2026-119468, https://patchstack.com/database/wordpress/plugin/newsletter-optin-box/vulnerability/wordpress-noptin-plugin-4-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
- 2026-11-04 HIGH: customer-area (https://todaywp.com/plugins/customer-area), Cross-site Scripting, up to 8.4.1. CVE-2026-57666, https://patchstack.com/database/wordpress/plugin/customer-area/vulnerability/wordpress-wp-customer-area-plugin-8-4-1-cross-site-scripting-xss-vulnerability-2?_s_id=cve
- 2026-11-04 HIGH: wp-booking-system (https://todaywp.com/plugins/wp-booking-system), Cross-site Scripting, up to 2.1.0.6. CVE-2026-57639, https://patchstack.com/database/wordpress/plugin/wp-booking-system/vulnerability/wordpress-wp-booking-system-plugin-2-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

## Check a site's plugins

Call the MCP tool wp_security with `plugins`: the site's plugin slugs, each optionally with its installed version (`akismet:5.3, woocommerce:9.1.0`, up to 60). For each plugin: the latest version, whether an update is due, last update, tested WordPress version, required PHP, and simple checks, and the known vulnerabilities for each, with whether they hit the installed version.

## WordPress branches

Older branches down to 4.7 still get backported core security fixes, best effort; below 4.7, none.

- WordPress 7.1: latest 7.1.4 (2026-10-28), active, PHP 7.4 - 8.5
- WordPress 7.0: latest 7.0.8 (2026-10-28), security only, PHP 7.4 - 8.5
- WordPress 6.9: latest 6.9.11 (2026-10-28), security only, PHP 7.2.24 - 8.5
- WordPress 6.8: latest 6.8.12 (2026-10-28), security only, PHP 7.2.24 - 8.4
- WordPress 6.7: latest 6.7.11 (2026-10-28), security only, PHP 7.2.24 - 8.4
- WordPress 6.6: latest 6.6.11 (2026-10-28), security only, PHP 7.2.24 - 8.3

## PHP branches

- PHP 8.5: latest 8.5.12, active, security fixes until 2029-12-31
- PHP 8.4: latest 8.4.27, active, security fixes until 2028-12-31
- PHP 8.3: latest 8.3.36, security only, security fixes until 2027-12-31
- PHP 8.2: latest 8.2.35, security only, security fixes until 2026-12-31
- PHP 8.1: latest 8.1.34, end of life, security fixes until 2025-12-31
- PHP 8.0: latest 8.0.30, end of life, security fixes until 2023-11-26

Not covered yet: plugin vulnerabilities. Check WordPress.org and your security scanner.