Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
6.4.13
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 6.4.13 Released

WordPress 6.4.13 is now available as a maintenance release for sites on the 6.4 branch, recommended to run with PHP 7.0.0 or later.

Maintenance release for WordPress 6.4.x Recommended PHP 7.0.0+
AI summary

WordPress 6.4.13 has been published as part of the ongoing maintenance of the 6.4 release branch. The official release notes do not list specific fixes beyond confirming availability of this build and the recommended PHP version, so this is best treated as a routine upkeep release for sites still running WordPress 6.4.x.

What this release covers

WordPress.org lists 6.4.13 as an available core version in the 6.4 series, alongside a recommendation to run PHP 7.0.0 or newer. No further details on specific bug fixes were published in the source notes for this build, which is typical for smaller maintenance point releases that primarily keep an older branch current and compatible.

Who should care

This update is relevant for site owners and administrators who are intentionally running the 6.4.x branch of WordPress rather than the latest major version — for example, due to plugin or theme compatibility constraints. If your site is already on a newer WordPress version (6.5 or later), this specific release does not apply to you.

How to update

Most WordPress installations apply minor core updates like this automatically in the background, in line with WordPress's standard practice of auto-updating maintenance releases unless automatic updates have been disabled. If auto-updates are off, you can update manually from the Dashboard under Updates, or via WP-CLI with `wp core update`. As always, confirm your hosting environment meets the recommended PHP 7.0.0+ requirement, though running a current, supported PHP version is generally advised for performance and security reasons.

Synthesized by AI from 1 source · updated 2 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email