WordPress 7.1.1 Released With 11 Security Fixes
WordPress 7.1.1, a critical maintenance and security release, addresses eleven vulnerabilities including stored XSS, API bypasses, and path traversal flaws.
WordPress has released version 7.1.1, a maintenance and security update aimed at patching eleven reported vulnerabilities and implementing seventeen bug fixes for the core software, alongside nineteen for the Block Editor. The release strongly urges users to update their installations immediately due to the nature of the security issues addressed.
The update is available for download from WordPress.org, or can be applied directly through the WordPress Dashboard. Sites with automatic background updates enabled will receive the update automatically. This release is part of a short-cycle update, with the next major version, 7.2, anticipated in December.
Among the critical security fixes are multiple cross-site scripting (XSS) vulnerabilities. One instance in wpautop() allows unauthenticated visitors to inject scripts, contingent on comment approval. Another stored XSS vulnerability affects themes with custom header support. Additionally, the HTML API has been patched to prevent bypasses that could allow for comment manipulation.
Further vulnerabilities addressed include an issue where specially crafted URLs could lead to the automatic installation and preview of inactive themes from WordPress.org. Site administrators are also protected from a vulnerability allowing network activation of network-only plugins. A path traversal vulnerability in the WP REST Templates Controller, reported by Anthropic, has also been remediated.
Other significant fixes include the patching of XML-RPC bypasses that could allow the publication of customize_changeset posts without proper authorization. A contributor-level arbitrary post overwrite vulnerability and a missing read check that could disclose private parent-post titles have also been resolved. Furthermore, a missing authorization flaw could lead to the disclosure of draft or pending post slugs, which is now fixed.
The WordPress security team has thanked numerous individuals and organizations for their responsible disclosure of these vulnerabilities, including Rafie Muhammad, Jeremy Felt, Paulos Yibelo, pwn.ai, Jesse McNeil, Anthropic, Ben Bidner, HDWSec, and hermanhms. The release was led by Adam Silverstein, Adrian Duffell, Andrei Draganescu, and Aaron Jorbin, with contributions from a wide array of community members and organizations.
Security fixes are being backported to eligible branches, including those up to version 4.7, though users are reminded that only the most recent WordPress version receives active support. The WordPress community continues to rely on collaborative efforts for maintaining the platform's security and stability.