WordPress 7.1.1 ships with 11 security fixes, a comment-triggered XSS and the Click2Shell chain
On September 17, 2026 WordPress released 7.1.1 as a security and maintenance release with 11 security fixes. Two stand out: a stored XSS in wpautop() that an anonymous visitor can trigger, subject to comment approval, and the Click2Shell CSRF chain that ends in server-side code execution. WordPress asks sites to update immediately.
A short-cycle release closes 11 security issues
Per the announcement Aaron Jorbin published on WordPress.org News on September 17, 2026, 7.1.1 is a security and maintenance release with 17 bug fixes on Core, 19 for the Block Editor and 11 security fixes. WordPress says sites should update immediately, via Dashboard > Updates > Update Now; sites with automatic background updates start it on their own.
7.1.1 is a short-cycle release; 7.2, the next major version, is planned for December with no exact day given. The release was led by Adam Silverstein, Adrian Duffell, Andrei Draganescu and Aaron Jorbin. Security fixes are being backported where necessary to every eligible branch, back to 4.7; only the most recent version is actively supported, WordPress reminds.
An XSS from an anonymous comment, Click2Shell, and nine fixes that mostly need an account
The announcement's first issue is a stored XSS in wpautop() that lets an unauthenticated visitor inject script; WordPress explicitly notes it is subject to comment approval and credits Rafie Muhammad of Awesome Motive. Patchstack's release breakdown, published September 18, tracks it as CVE-2026-93485 with a CVSS 3.1 score of 7.1. Per Patchstack, the payload is an ordinary comment from an anonymous visitor, and the root cause is a regular expression in wpautop() that was not aware of quoted attribute values. Script then runs in the site's origin for any visitor who loads that page, logged in or not. Patchstack's limiting factor: the comment must be published. On a stock install first-time commenters wait for moderation, but anyone approved once is auto-approved later. Patchstack's warning: "moderation isn't a security control". Patchstack's timeline: reported September 15, fixed September 17, published September 18.
The second headline is Click2Shell, reported by Paulos Yibelo of pwn.ai. Patchstack researcher Chazz Wolcott's September 18 analysis describes a CSRF-to-selector-injection chain: the server side sanitizes the theme slug in the install URL, but wp-admin's JavaScript drops the raw value into a jQuery selector unsanitized, so the page acts as if the admin had clicked Install on an unrelated theme. pwn.ai's chain used a real catalog theme, Mobile Repair Zone 2.5.4: the URL installs it silently, a second link opens the Customizer, and an AJAX handler in its functions.php, with no nonce or capability check, fetches an attacker-owned ZIP and runs it as a plugin. A logged-in site administrator has to load the URL, via targeted phishing or an existing XSS; an Author or Editor cannot trigger it. With DISALLOW_FILE_MODS enabled, the impact stops short of installing new themes or plugins; the fix escapes the slug with $.escapeSelector().
The remaining nine fixes: an HTML API comment breakout and a stored XSS in some custom-header themes (Jeremy Felt); a Site Administrator network-activating a Network-only plugin (Jesse McNeil); a REST Templates path traversal and a Contributor-level post overwrite (Anthropic); an XML-RPC edit_css bypass (Ben Bidner); a private parent post title leak (HDWSec); draft slug disclosure (Jakub Herman); comments reparentable by any authenticated user (Justin Hart). Patchstack notes that the ten fixes other than wpautop() are mostly access-control and disclosure issues that need an account.
Two risk profiles: an anonymous comment and a single admin click
Two headline flaws set this release apart: the wpautop() issue starts with a visitor on any site with public comments, while Click2Shell reaches code execution from one click by a logged-in administrator. Both have limits: the comment must be approved, the administrator must open the link. None of the three sources reports in-the-wild exploitation of any of the 11 issues. Patchstack's broader lesson: a parameter processed on both backend and frontend must be sanitized on both sides.
The sources do not mention Türkiye; the update reaches every site the same way
None of the three sources mentions Türkiye: no regional rollout, no usage figure for the country, no statement from Turkish hosting providers, no report of exploitation there. 7.1.1 is a global core release; a site in Türkiye gets it through Dashboard > Updates or, with automatic background updates on, by itself. As an industry observation, many small business sites in Türkiye run on WordPress; the sources give no figure. Two practical questions remain: are automatic core updates on, and are comments public? Comments open plus updates off is the profile this release addresses.
The UNALSOFT view
Our reading: security releases should be routine, not news. In our web design and maintenance work we ask four questions on every site: are automatic core updates on; if comments are open, is there moderation, knowing that moderation alone is not a security control; are hardening constants like DISALLOW_FILE_MODS defined; and have administrator account holders been warned about phishing links? Both headline flaws in 7.1.1 pass through these four points. A site without a maintenance arrangement can sit on an old version for months unnoticed; the sources do not measure the cost of skipping this release, but they spell out the holes it closes.
Has your WordPress site been updated to 7.1.1?
Let's review core updates, comment settings and administrator account security together. A short conversation is enough to start.