WordPress 7.1.1: 11 Security Fixes While WP2Shell Exploitation Hits 45 Million Attempts

If you run WordPress, yesterday was patch day — again. On September 17, the WordPress team released version 7.1.1 and simultaneously backported the same fixes to 7.0.5 for sites on the 7.0.x branch. The release covers 11 security vulnerabilities and 36 additional bug fixes across Core and the Block Editor. WordPress core releases typically skip CVE assignments, so there are no CVE numbers attached yet — but the advisory calls for immediate updates across all affected installations.

What the 11 Fixes Cover

The security issues span several vulnerability classes that matter for any site carrying user-generated content, theme customization, or a multisite deployment:

• Stored XSS in wpautop() — An unauthenticated visitor can inject script into content, subject to comment approval. Default comment moderation is the only gate; no login required.
• HTML API comment-escape bypass — set_modifiable_text() allowed breaking out of a comment node via abrupt-closing sequences, creating a second unauthenticated XSS path.
• Stored XSS in custom-header themes — Themes that support custom headers carry this flaw; exploitation requires elevated permissions but results in persistent script execution for every visitor.
• Authenticated path traversal in WP REST Templates Controller — An authenticated user with block-template access can traverse outside the expected file scope using a crafted template name.
• Contributor-level arbitrary post overwrite — Users with Contributor access only could overwrite posts they did not own, a privilege-escalation risk on any multi-author site.
• Draft and pending post slug disclosure — Missing authorization checks exposed slug information for unpublished content to Contributor-level and above users.
• Private parent post title leak via attachments — Attachment metadata leaked the title of a private parent post to users who have no business seeing it.
• Crafted-URL theme auto-install — A specially crafted URL could silently trigger installation and preview of an inactive theme from WordPress.org without explicit admin intent.
• XML-RPC capability bypass — The XML-RPC interface could publish customize_changeset posts while skipping the edit_css capability check entirely.
• Multisite Network-only plugin activation — A site administrator could network-activate plugins marked Network-only, stepping outside the permission scope the multisite model is supposed to enforce.

No active exploitation of these 7.1.1-specific issues has been confirmed at this writing, and no public proof-of-concept code is known. That window tends to close within hours of a release, not days.

The Backdrop: WordPress Core Has Had a Rough Summer

The 7.1.1 release lands in the wake of what has been an unusually heavy year for WordPress core security. In July 2026, the team rushed out 7.0.2 and 6.9.5 to patch the WP2Shell chain — CVE-2026-63030 and CVE-2026-60137 — a two-flaw sequence that gives an unauthenticated attacker remote code execution on a default WordPress install with no plugins and no special configuration required. The chain starts in the REST API batch processor, where a logic error in array handling causes requests to dispatch under the wrong handler; that access is leveraged through a SQL injection in WP_Query's author__not_in parameter, which enables privilege escalation to administrator and ultimately code execution against the underlying server.

The full chain affected WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1; versions 6.8.0 through 6.8.5 carried the SQL injection component but not the full RCE path. CISA added both CVEs to its Known Exploited Vulnerabilities catalog within four days of disclosure. WPScan assigned a CVSS v3.1 score of 9.8. In the first week alone, security researchers tracked more than 45 million exploit attempts from nearly 150,000 unique sources. By September, CrowdSec was still logging 62,802 distinct attacking IPs probing for unpatched installations.

That number matters because the patch gap is still large. At disclosure time, roughly 60 percent of organizations using WordPress had at least one vulnerable instance; 25 percent had a vulnerable server internet-exposed. WordPress.org enabled forced automatic updates, but forced updates don't reach sites managed by hosts that disable them, sites where the filesystem is read-only, or the countless sites handed off to a contractor two years ago and quietly forgotten.

Why Core Updates Keep Getting Skipped

Plugin updates get attention because security scanners surface them loudly. Core updates are noisier — they touch everything, occasionally break custom code, and demand a regression pass if you're running anything non-standard. That asymmetry means security releases age on staging while production runs exposed. The WP2Shell window has been open since July; the 7.1.1 fixes add eleven more reasons to close it.

Automatic background updates help, but they're not a complete answer. They run on a schedule, skip major-version jumps, and don't run on installations with read-only filesystems or locked configuration. At scale, the reliable approach is active monitoring of version status across every managed site and treating any WordPress security release as an open incident until the updated version is confirmed in production.

What to Do Right Now

• Update to 7.1.1 or 7.0.5 today. If you are on any 7.1.x release prior to 7.1.1, or any 7.0.x release prior to 7.0.5, apply the update from Dashboard → Updates. If you're still on anything between 6.9.0 and 7.0.1, you were already overdue months ago for WP2Shell.
• Verify automatic updates actually ran. Don't assume — confirm the installed version number. Auto-updates can silently fail.
• Audit XML-RPC usage. The capability bypass fixed in 7.1.1 adds to XML-RPC's long list of attack-surface concerns. If your site or integrations don't specifically require it, disable it.
• Check comment approval workflows. The wpautop() XSS path requires comment moderation to be enabled, but moderation queues get approved in bulk. Consider whether comment functionality is worth the maintenance overhead on sites where it adds no value.
• Scan sites that ran vulnerable WP2Shell versions for indicators of compromise. Look for unexpected PHP files in wp-content/uploads/, administrator accounts you didn't create, and silently installed plugins. Attackers planting persistent webshells don't announce themselves — CrowdSec found 62,802 IP addresses still probing for a reason.

At Falcon Internet, 24x7x365 NOC monitoring means we're watching version status across managed sites and flagging any that haven't picked up a security release within hours of it dropping — because in 2026, the measured time from "patch available" to "PoC published" has routinely been under a day.