Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
5.8.18
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 5.8.18 Released

WordPress 5.8.18 is now available as part of the 5.8 maintenance branch, recommended for sites still running on this legacy series, with PHP 5.6.20 listed as the recommended PHP version.

5.8 maintenance branch Recommended PHP 5.6.20 Routine update, no detailed fixes listed
AI summary

WordPress 5.8.18 has been published on WordPress.org as part of the 5.8 maintenance line. This release is relevant primarily to site owners and hosts who, for compatibility or legacy reasons, are still running the older 5.8 branch rather than the current major version of WordPress. The published notes are minimal, listing the new version number and a recommended PHP version.

What's in this release

The official release information for WordPress 5.8.18 is brief: it confirms the new version is available and lists PHP 5.6.20 as the recommended PHP version to pair with it. No specific bug fixes, security patches, or feature changes are detailed in the source notes, so this appears to be a routine maintenance update for the 5.8 series rather than a release addressing a disclosed issue.

Why this matters for your stack

Sites still on the 5.8 branch are typically there because of plugin, theme, or hosting constraints that prevent moving to a current major WordPress release. For these sites, staying current within the 5.8 maintenance line is the main way to receive fixes without a full major-version upgrade. It's worth noting that PHP 5.6 itself has been end-of-life for several years and no longer receives security updates from the PHP project, so pairing WordPress with it carries inherent risk regardless of the WordPress version in use.

How to update

WordPress core can be updated from the Dashboard under Updates, through WP-CLI with `wp core update`, or by hosts applying updates on your behalf if auto-updates are enabled for minor/maintenance releases. As with any core update, taking a full backup of files and database beforehand is good practice, and testing on a staging environment is recommended for sites with custom plugins or themes before updating production.

Synthesized by AI from 1 source · updated 2 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email