Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
6.9.10
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 6.9.10 Released

WordPress 6.9.10 is now available, a maintenance release in the 6.9 series for WordPress core, recommended for use with PHP 7.2.24.

WordPress core 6.9.10 Recommended PHP 7.2.24 Routine maintenance release
AI summary

WordPress.org has listed version 6.9.10 of WordPress core on its releases page. As a point release within the 6.9 series, it continues the ongoing maintenance of WordPress and is relevant to anyone running a self-hosted WordPress site, from individual bloggers to agencies managing many installs.

What's in this release

The official release notes for 6.9.10 are brief, stating simply that the version is available and that the recommended PHP version to run alongside it is 7.2.24. No specific list of bug fixes, security patches, or new features was published alongside this entry, so this appears to be a routine maintenance build within the 6.9 release line rather than a release introducing new functionality.

How to update

Most WordPress sites configured for automatic background updates will receive minor core releases like 6.9.10 without any manual action. Site owners who have disabled automatic updates, or who manage WordPress through a hosting dashboard or version control, can update by visiting the Updates screen in wp-admin and clicking 'Update Now', or by downloading the package directly from WordPress.org. As always, taking a backup before updating is good practice, even for routine point releases.

PHP compatibility note

WordPress.org lists PHP 7.2.24 as the recommended version to pair with 6.9.10. Site owners should check their hosting environment's PHP version against this recommendation; running a current, supported PHP version is generally advisable for performance and ongoing security support from the PHP project itself, independent of what WordPress core requires at minimum.

Synthesized by AI from 1 source · updated 2 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email