Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
4.7.38
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 4.7.38 Released

WordPress 4.7.38 is now available as a maintenance update for the legacy 4.7 branch, with PHP 5.2.4 listed as the recommended minimum PHP version.

Maintenance update 4.7.x legacy branch Recommended PHP 5.2.4
AI summary

WordPress.org has published version 4.7.38, an update to the long-running 4.7 release branch. This release is relevant primarily to site owners and hosts who are still running older WordPress 4.7.x installations rather than a current major version. The official release notes are brief, so this briefing reflects only what has been confirmed: the version number and the recommended PHP version.

What's in this release

The WordPress.org releases page lists 4.7.38 as the current build in the 4.7 branch, with PHP 5.2.4 noted as the recommended PHP version for compatibility. No further changelog detail has been published alongside this entry, which is typical for maintenance builds in older WordPress branches that primarily backport compatibility or stability fixes rather than introduce new functionality.

Why this matters for your stack

WordPress 4.7 is a legacy major version, and sites still on this branch are generally far behind the current WordPress release line. While 4.7.38 keeps that branch running, site owners should treat it as a signal to evaluate a full upgrade path to a supported WordPress major version, since older branches receive a narrower scope of fixes and will not include newer platform improvements.

Upgrading your site

As with any WordPress core update, the update can typically be applied via the Dashboard's built-in updater, through a host-managed auto-update system, or by downloading the package directly from WordPress.org. Before updating, it's good practice to confirm your hosting environment's PHP version against the recommendation, take a backup, and verify theme and plugin compatibility, particularly if the site has not been updated in some time.

Synthesized by AI from 1 source · updated 1 hour ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email