Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
6.1.15
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 6.1.15 Released

WordPress 6.1.15 is now available as a maintenance release for sites on the 6.1 branch, with PHP 5.6.20 recommended as the minimum PHP version to run it on.

Maintenance release for WordPress 6.1.x Recommended PHP 5.6.20 No specific fixes listed
AI summary

WordPress 6.1.15 has been published on WordPress.org as the latest update in the 6.1 release series. This is a maintenance release intended for site owners who are still running WordPress 6.1.x and have not yet upgraded to a newer major version. The official notes are brief, noting only the recommended PHP version for this release.

What this release covers

The official release entry for WordPress 6.1.15 does not list specific bug fixes or security patches. It simply confirms availability of the build and states that PHP 5.6.20 is the recommended PHP version for running it. Releases like this typically round out a legacy branch with accumulated compatibility and stability updates rather than introducing new features, since 6.1 is an older line that has since been succeeded by newer WordPress major versions.

Who should care

This update is relevant to site owners and hosting providers who are intentionally keeping sites on the WordPress 6.1 branch, for example due to plugin or theme compatibility constraints. If your site is already running a newer major version of WordPress (6.2 or later), 6.1.15 does not apply to you. For sites still on 6.1.x, applying this update keeps you current within that branch pending a full upgrade.

How to update

Most WordPress installations with background updates enabled will receive maintenance releases like this automatically, since WordPress core auto-updates minor releases by default. Site owners can also trigger the update manually from the Dashboard under Updates, or via WP-CLI with `wp core update`. As with any core update, it's good practice to have a recent backup beforehand, and to confirm your hosting environment meets the recommended PHP version noted in the release.

Synthesized by AI from 1 source · updated 6 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email