Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
5.9.19
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 5.9.19 Released

WordPress 5.9.19 is now available as a maintenance release for sites running the 5.9 branch, with PHP 5.6.20 recommended as the minimum environment.

WordPress 5.9.x maintenance release PHP 5.6.20 recommended No specific fixes detailed
AI summary

WordPress.org has published version 5.9.19, a maintenance update for sites still running the 5.9 branch of WordPress core. This release is aimed at keeping older-branch installs current rather than introducing new functionality. Site owners and agencies managing legacy WordPress 5.9 deployments should take note.

What's in this release

The official release notes for 5.9.19 are brief, stating simply that the version is available and recommending PHP 5.6.20. No specific bug fixes, enhancements, or security corrections are called out in the published notes, which suggests this is a routine maintenance build for the 5.9 line rather than a release tied to a particular issue.

Why it matters for your stack

WordPress maintains older branches like 5.9.x with periodic point releases so that sites unable to move to the latest major version still receive maintenance updates. If you're running a site on the 5.9 branch, staying on the latest point release within that branch (now 5.9.19) is good hygiene, even when the changes are modest. It's also worth noting that PHP 5.6 reached end of life years ago and is no longer supported by the PHP project itself; the recommendation in the notes reflects WordPress's historical minimum compatibility target for this branch rather than a current best practice, and most hosts today run far newer PHP versions.

How to update

Sites configured for automatic background updates on minor WordPress releases will typically receive 5.9.19 without any action needed. Others can update manually from the WordPress dashboard under Updates, or by downloading the release directly from wordpress.org/download/releases/. As always, a backup before updating and a quick check of key site functionality afterward is recommended practice.

Synthesized by AI from 1 source · updated 2 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email