WordPress Today: Latest Releases and What Site Owners Should Do

WordPress powers a very large number of business websites, so its release notes matter even if you never open the dashboard. October 2026 was busy: a critical PHP security release on 21 October and a WordPress security release a week later. This post explains the news in plain terms and what a site owner should do.

The recent releases in order

• WordPress 7.0, 20 May 2026. A major release, named Armstrong. WordPress's version history page points to features such as an AI client layer, a font library and view-transition support, but check the official announcement for the exact feature list.
• WordPress 7.1.3, 6 October 2026. A maintenance and security release.
• Critical PHP security release, 21 October 2026. This concerns PHP, the programming language WordPress runs on, rather than WordPress itself.
• WordPress 7.1.4, 28 October 2026. A security release and the latest version at the time of writing.
• WordPress 7.2. Currently planned for 8 December 2026, with beta versions already out. Dates in open-source projects can move.

What WordPress 7.1.4 fixed

The release post lists fixes for multiple security issues. The most serious sounds technical but is easy to translate: a weakness in the upgrade process that could allow an attacker to run their own code on the site during the upgrade window. Others include several stored cross-site scripting flaws, where harmful code saved inside content or settings later runs in a visitor's or administrator's browser, and one denial-of-service flaw that could make a site unavailable. A weakness that exposed unpublished draft changes to anonymous visitors was also fixed. Fixes were also backported to older branches that still receive security fixes, and the post recommends updating immediately. Sites with automatic background updates should receive 7.1.4 on their own.

The PHP warning is the one to read twice

On 21 October WordPress published a notice about two critical PHP vulnerabilities. It says that no WordPress update is required or planned for them, so a site can be fully up to date and still exposed. The advice:

1. Find your PHP version: in WordPress, open Tools, then Site Health, then Info, then Server, or look in your hosting control panel.
2. Ask your host whether the PHP fix is applied. Some hosts patch quickly, but confirm it rather than assume.
3. If you are on a PHP version older than 8.2, act first, because the PHP project no longer issues security updates for those versions.
4. If you run your own server on an old PHP, the notice says to consider taking it offline until you can upgrade.
5. If you suspect a break-in, follow WordPress's hacked-site guidance.

WordPress currently recommends PHP 8.3 or newer, and MariaDB 10.11 or MySQL 8.0 or newer. It still runs on PHP 7.4, but its requirements page warns that these versions are end of life.

The plugin reality

The core of WordPress is reviewed by a large community. The risk usually sits around it: plugins and themes written by thousands of different authors, some abandoned. Every plugin you add is code that must be updated. A typical business site with a dozen plugins therefore needs someone to apply updates every few weeks, remove plugins that are no longer maintained, and take backups before updating. We have not found a reliable, current official figure on how many incidents start in plugins, so we will not quote one; the pattern is simply that the more plugins you run, the more places there are to patch.

When WordPress is still the right answer

WordPress is a good fit when you publish content often, want non-technical staff to edit pages, and your needs match what well-known plugins already do: a blog, a brochure site, a small shop. It is quick to start and cheap to hire for. A custom-built site suits you better when you need unusual logic, such as student fee workflows, booking rules, wallets or role-based dashboards, or when you want fewer moving parts to patch. Our detailed comparison of Next.js versus WordPress walks through both sides, and our CMS glossary entry explains what a content management system does.

What to do this week

1. Log in and update WordPress to 7.1.4 if automatic updates have not done it.
2. Check the PHP version and confirm the fix with your host.
3. Update or delete every plugin and theme that shows an update or has not been maintained in a long time.
4. Make sure a recent backup exists that you can actually restore.
5. Turn on two-step login for every administrator account.

VS Tech Builders builds sites on Next.js rather than WordPress, which suits clients who want fewer plugins to patch, but we are happy to give an honest view on whether your current WordPress site should stay. See our corporate website service or contact us, and read what website maintenance really costs.

Sources

Checked on 3 November 2026. Technology changes quickly; always confirm details with the official source before you act on them.

• WordPress 7.1.4 — WordPress.org News
• Critical PHP Security Release — WordPress.org News
• Version 7.0 — WordPress.org Documentation
• WordPress Requirements — WordPress.org
• WordPress News — WordPress.org

Frequently asked questions

Do I need to update to WordPress 7.1.4?

Yes, update as soon as you can. It is a security release that fixes several issues, including a weakness in the upgrade process. Many sites update automatically in the background, but check your dashboard to confirm. Take a backup first if you manage the site manually.

Is my WordPress site at risk if it is fully updated?

Possibly. The October 2026 PHP security release affects the server software underneath WordPress, and WordPress said no update to itself is planned for it. Confirm with your hosting provider that PHP is patched and running a supported version, ideally 8.3 or newer.

How do I check my PHP version in WordPress?

In the dashboard, open Tools, then Site Health, then the Info tab, then Server. The PHP version is listed there. You can also see it in your hosting control panel. If the version is older than 8.2, contact your host about upgrading soon.

Is WordPress or a custom website better for my business?

It depends on your needs. WordPress suits blogs, brochure sites and small shops with frequent content changes. A custom build suits unusual workflows, dashboards and integrations, and can reduce the number of plugins to patch. Compare the cost of ongoing maintenance, not only the price of the first build.