Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
5.6.22
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 5.6.22 Released

WordPress 5.6.22 is now available as a maintenance update for sites still running the 5.6 branch. The WordPress.org release notes list a recommended PHP version of 5.6.20 alongside this update.

Maintenance release for the 5.6 branch Recommended PHP 5.6.20
AI summary

WordPress 5.6.22 is a maintenance release in the older 5.6 branch of WordPress core, intended for sites that have not yet moved to a more recent major version. Site owners and developers still running this branch should take note, particularly because of the PHP version guidance that accompanies the release.

What's in this release

According to the official WordPress.org release listing, version 5.6.22 is available for download, with a recommended PHP version of 5.6.20 called out alongside it. No further specifics about fixed bugs or changed behavior were included in the published notes, so this appears to be a routine maintenance build for the 5.6 branch rather than a release introducing new functionality.

Why this matters for your stack

WordPress maintains legacy branches like 5.6.x to give site owners running older, unchanged environments a path to incremental updates without forcing a jump to a newer major version. If your site is still on 5.6, keeping it current within that branch reduces the risk of running an unpatched build, even when the specific changes in a given point release are minimal or undocumented in detail.

How to update

Most WordPress installations configured for automatic background updates will pick up minor releases like 5.6.22 without any action needed. If automatic updates are disabled, administrators can update from the Dashboard under Updates, or by downloading the release directly from the WordPress.org releases archive and deploying it manually. Given the explicit PHP 5.6.20 recommendation in this release's notes, it's also worth checking your hosting environment's PHP version to confirm it aligns with what's recommended for this WordPress branch.

Synthesized by AI from 1 source · updated 2 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email