Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
5.5.23
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 5.5.23 Released

WordPress 5.5.23 is now available as a maintenance update for sites running the 5.5 branch, with PHP 5.6.20 noted as the recommended PHP version.

5.5 branch maintenance release PHP 5.6.20 recommended
AI summary

WordPress 5.5.23 has been published on WordPress.org as the latest build in the 5.5 release line. This is a maintenance release for site owners and hosts who are still running WordPress 5.5.x rather than a newer major version. The accompanying release notes are brief, primarily flagging PHP 5.6.20 as the recommended PHP version for this build.

What's in this release

The official release notes for WordPress 5.5.23 are minimal, stating that the version is available and recommending PHP 5.6.20 alongside it. No specific bug fixes, security patches, or new features are itemized in the published notes, so this update should be treated as a routine maintenance build for the 5.5 series rather than one carrying a known set of functional or security changes.

Who this applies to

This release matters primarily to sites that are deliberately staying on the WordPress 5.5 branch, for example due to plugin or theme compatibility constraints, rather than running the current major version of WordPress. If your site auto-updates to the latest major release, 5.5.23 is unlikely to be the version you end up on; it's relevant specifically for installations pinned to 5.5.x.

Upgrade notes

As with any WordPress core update, most sites will receive maintenance releases like this automatically in the background unless automatic background updates have been disabled. Site owners who manage updates manually can apply 5.5.23 via the Dashboard's Updates screen, WP-CLI (`wp core update`), or by downloading the package from WordPress.org. Given the mention of PHP 5.6.20 as the recommended version, it's worth checking your hosting environment's PHP version, keeping in mind that PHP 5.6 itself has long been past its own end-of-life upstream, so newer PHP versions are generally advisable where your plugins and themes support them.

Synthesized by AI from 1 source · updated 2 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email