Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
5.7.20
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 5.7.20 Released

WordPress 5.7.20 is now available as a maintenance update to the 5.7 branch, recommended for sites still running on this older major version.

WordPress 5.7.20 Maintenance update Recommended PHP 5.6.20
AI summary

WordPress 5.7.20 has been published as part of the ongoing maintenance for the 5.7 release branch. This update is relevant for site owners and developers who are still running WordPress 5.7.x and have not yet moved to a newer major version. As with other point releases in older branches, it is intended to keep sites on this line running smoothly rather than to introduce new functionality.

What's in this release

The official release notes for 5.7.20 are brief, simply confirming that the update is available and noting a recommended PHP version of 5.6.20. No specific bug fixes, security patches, or new features are detailed in the published notes for this version.

Why your PHP version matters

WordPress core has long recommended running on actively supported, up-to-date PHP versions for performance and security reasons. The recommendation attached to this release reflects the PHP version WordPress was tested against for this branch. Site owners should check with their hosting provider to confirm which PHP version their environment is running and whether it aligns with current best practices, since PHP itself has its own separate support lifecycle independent of WordPress.

Upgrade notes

Sites still running the 5.7 branch can typically apply this update through the standard WordPress dashboard update mechanism, via WP-CLI, or through automatic background updates if enabled. Given that 5.7 is an older major release line, teams should also use this as an opportunity to evaluate whether it's time to plan a move to a current, actively maintained WordPress version, as older branches eventually stop receiving updates.

Synthesized by AI from 1 source · updated 2 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email