Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
5.2.29
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 5.2.29 Released

WordPress 5.2.29 is now available as a maintenance release in the 5.2 branch, recommended alongside PHP 5.6.20.

Maintenance release 5.2 branch Recommended PHP 5.6.20
AI summary

WordPress 5.2.29 has been published on WordPress.org as part of the older 5.2 maintenance branch. This release is relevant primarily to site owners and hosts who are intentionally running an older WordPress major version and keeping it current with its own maintenance updates, rather than moving to the latest core release line.

What's in this release

The official release notes for 5.2.29 are brief, noting only that the version is available and that it is recommended to run it with PHP 5.6.20. No specific bug fixes, feature changes, or security items are called out in the published notes for this version.

Why this matters for your stack

Sites still running the WordPress 5.2 branch are typically there deliberately, often due to plugin, theme, or custom code compatibility constraints. Maintenance releases like this one are the mechanism by which that branch continues to receive upkeep. Pairing the release with the recommended PHP version (5.6.20 in this case) helps ensure the documented compatibility baseline is respected, though site owners should be aware that PHP 5.6 itself is long past its own upstream support window, which carries its own risk considerations independent of WordPress.

How to update

WordPress core can be updated from the Dashboard under Updates, via WP-CLI (`wp core update`), or by replacing core files manually per the standard WordPress upgrade procedure. As with any core update, taking a full backup of files and database beforehand is standard practice, and testing on a staging copy is advisable, particularly for sites with custom themes or plugins tied to this older branch.

Synthesized by AI from 1 source · updated 2 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email