Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
5.1.27
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 5.1.27 Released

WordPress 5.1.27 is now available as a maintenance release for sites still running the legacy 5.1 branch.

Maintenance release for WP 5.1 branch Minimum PHP 5.2.4
AI summary

WordPress 5.1.27 has been published as part of the ongoing maintenance of the older 5.1 release line. This update is mainly relevant for site owners and agencies who, for compatibility or legacy reasons, are still running WordPress 5.1 rather than the current core version.

What's in this release

The official release notes for 5.1.27 are minimal, simply confirming availability of the update and listing PHP 5.2.4 as the recommended minimum PHP version for this branch. No specific bug fixes, feature changes, or security advisories were detailed in the source notes, so this appears to be a routine maintenance build within the 5.1.x series.

Why this matters for your stack

Running an older major version line like 5.1 means you miss out on newer WordPress core features and the security hardening introduced in later major releases. If your site is still on 5.1.x, it's worth evaluating whether an upgrade path to a current, actively supported WordPress version is feasible, since very old branches eventually stop receiving even maintenance updates.

How to update

Sites configured for automatic background updates will typically receive maintenance releases like 5.1.27 without manual action. For sites with auto-updates disabled, the update can be applied from the WordPress admin dashboard under Updates, or by downloading the package directly from WordPress.org. As with any core update, taking a full backup beforehand is good practice, and legacy environments should also confirm their PHP version meets the stated minimum of 5.2.4.

Synthesized by AI from 1 source · updated 2 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email