If you asked what’s new in WordPress this week, the honest answer is a security drop plus a published plan for December. WordPress 7.1.1 shipped on 17 September 2026. The next major, 7.2, is aimed at 8–10 December 2026. At 7 Sync Technologies that is the pair of facts we care about on client sites: patch now, plan the editor and security work for December.
This recap is for agencies and site owners, not a copy of Trac. Official sources: the 7.1.1 release post and the roadmap to 7.2.
WordPress 7.1.1: update this, not later
7.1.1 is a short-cycle maintenance and security release. It includes 17 core bug fixes, about 20 block editor fixes, and 11 security fixes. WordPress.org recommends updating immediately. Sites on automatic background updates should already be moving.
The security work covers stored XSS, HTML API comment handling, custom-header themes, REST template path issues, XML-RPC changeset publishing, comment/note reparenting, and a few authorization gaps for contributors. You do not need the CVE list in your head. You need 7.1.1 on production after a backup.
Fixes are also being backported to older branches (as far back as 4.7 where needed). Only the latest WordPress is actively supported. If a client is still on 6.x, treat 7.1.1 as the reason to schedule a real upgrade, not another delay.
This site is already on 7.1.1. For a plugin stack that belongs next to a current core version, see 10 must-have WordPress plugins.
What’s new in WordPress 7.2 (planned, not shipped)
Make WordPress published the 7.2 roadmap on 18 September. Nothing on that list is guaranteed. Features land if they are reasonably ready. Here is what they are actually building.
Notes: suggestions and emoji, not just comments in a sidebar
Collaboration is the headline. Notes should get emoji reactions, floating notes in the canvas margin (closer to Google Docs), and a suggest mode where edits can be accepted or rejected. If you review client copy in the editor, this is the 7.2 item to watch.
Security: sudo mode, Secrets API, Application Passwords
Core is aiming at three security projects:
- Sudo mode — re-authenticate before sensitive actions
- Secrets API — a first-class place to store credentials instead of options tables and wp-config scraps
- Application Passwords hardening — better HTML processing and safer use for APIs and AI agents
If you connect Cursor or Claude to WordPress, Application Passwords are already required. Hardening them in core is overdue. More on that stack is in AI implementation on WordPress.
Blocks: Description List and Table of Contents
Two library additions are named for 7.2: a Description List block and the long-requested Table of Contents block. Global Styles should cover form elements, more responsive states, and inherited styles that actually show on the block. Paper-cut writing fixes and a copy button on error messages are also in the plan.
Admin: SVG icons, extensible Site Editor, Ipsum theme
The admin bar and menu should swap dashicons for SVGs. Plugin authors may finally register their own Site Editor screens and settings. DataViews and DataForms get more server-side registration. A new default theme, Ipsum, is described as a minimal blank canvas for building on, not another opinionated blog look.
AI stays in the plugin (on purpose)
The 7.1 cycle said AI must prove adoption before it belongs in core. For 7.2 the work stays in the canonical AI plugin: more abilities (including write and extra read coverage), an MCP Adapter update and .org listing, easier MCP enablement, WebMCP experiments, agent identity, embeddings, and streaming in the PHP AI Client. Test the plugin if you want those features in core later. Do not wait for 7.2 to “add ChatGPT to WordPress.”
What we will do on client sites
At 7 Sync Technologies in Rajkot the next two weeks are 7.1.1 everywhere it is missing, then a staging watch on Gutenberg Notes and sudo mode as 7.2 betas appear in October. We will not rebuild live themes onto Ipsum on day one. Classic Editor sites can stay classic; the security release still applies.
More WordPress notes sit in the WordPress category. If you want a 7.1.1 check or a 7.2 staging plan, use the contact page.
Quick checklist
- Backup, then update to WordPress 7.1.1
- Update plugins and the theme on staging first
- Confirm Application Passwords still work if you use MCP or REST apps
- Do not expect core ChatGPT in December; use the AI plugin if you need it
- Watch 7.2 betas from late October for Notes and sudo mode
- Skip Ipsum on production until you have previewed a rebuild
That is what’s new in WordPress at the end of September 2026: a required security update today, and a December major that is about collaboration, credentials, and editor polish rather than a new chatbot in core.
Featured photo: Deng Xiang on Unsplash.
Recent Comments