Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
6.5.13
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 6.5.13 Released

WordPress 6.5.13 is now available as a maintenance release for sites running the 6.5 branch, with PHP 7.0.0 listed as the recommended minimum.

Maintenance release 6.5.x branch Recommended PHP 7.0.0
AI summary

WordPress 6.5.13 has been published as part of the ongoing maintenance of the 6.5 release series. This update is relevant to site owners and administrators who are still running WordPress 6.5.x and want to stay current within that branch before considering a move to a newer major version.

What's in this release

The official WordPress.org release listing confirms the availability of version 6.5.13 but does not itemize specific bug fixes beyond noting the recommended PHP version for this release, which remains PHP 7.0.0. As with other point releases in a maintenance branch, updates of this kind typically consist of small, accumulated fixes rather than new features, though no individual changes are detailed in the source notes for this version.

How to update

Most WordPress installations configured for automatic background updates will receive 6.5.13 automatically, as minor core releases are pushed out this way by default. Site owners who manage updates manually can apply the new version from the Dashboard under Updates, or by downloading the release package directly from WordPress.org. As always, it's good practice to have a current backup before applying any core update, even routine ones.

Compatibility notes

WordPress.org lists PHP 7.0.0 as the recommended minimum PHP version for 6.5.13. For better performance and ongoing security support from the PHP project itself, running a more recent, actively supported PHP version is generally advisable regardless of what a given WordPress release technically requires. Sites still on the 6.5 branch should also note that newer major WordPress versions exist, and a longer-term upgrade path may be worth planning separately.

Synthesized by AI from 1 source · updated 2 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email