WordPress 6.9.2 Security Release Now Available

March 2026 brings a focused patch that targets security weaknesses rather than feature changes. If you manage multiple WordPress installs, treat this as an operational priority, especially where public-facing upload, menu, and admin workflows are in regular use.

You can update by downloading WordPress 6.9.2 from WordPress.org or by visiting your WordPress Dashboard, selecting “Updates”, then clicking “Update Now”. For sites configured for automatic background updates, rollout will begin automatically.

On managed hosting, check any staging-to-production promotion rules and deployment locks. A security-only patch can still touch core libraries and admin behaviours that may interact with MU-plugins, object caching, or WAF rules.

A Blind SSRF issue was reported by sibwtf, and subsequently by several other researchers while the fix was being worked on. This category matters most on networks with internal metadata services, private APIs, or relaxed egress controls.

A PoP-chain weakness in the HTML API and Block Registry was reported by Phat RiO. If you rely heavily on block registration patterns across multiple plugins, this is the kind of core hardening that reduces exploit chaining risk.

A regex DoS weakness in numeric character references was reported by Dennis Snell of the WordPress Security Team. Regex-based denial-of-service tends to show up as sudden CPU spikes on crafted inputs, so patching reduces both security and stability exposure.

A stored XSS in nav menus was reported by Phill Savage. Stored XSS is particularly relevant in workflows where multiple users can edit menus or where admin sessions are long-lived.

An AJAX query-attachments authorisation bypass was reported by Vitaly Simonovich. Media library endpoints are common targets, so ensure the update is applied on any site with contributor access or third-party editorial tooling.

A stored XSS via the data-wp-bind directive was reported by kaminuma. This is notable for sites using modern block and binding patterns, where templating and dynamic attributes can expand the attack surface.

An XSS that allows overridding client-side templates in the admin area was reported by Asaf Mozes. Admin-side XSS has an outsised impact because it can pivot into plugin installation, credential theft, or persistent changes.

A PclZip path traversal issue was reported independently by Francesco Carlucci and kaminuma. Path traversal flaws are high value when archives are handled server-side, including during updates and package extraction paths.

An authorisation bypass on the Notes feature was reported by kaminuma. If Notes is part of your editorial or operational workflow, the fix tightens access controls around that functionality.

An XXE in the external getID3 library was reported by Youssef Achtatal. The WordPress security team coordinated a fix with getID3 maintainer James Heinrich, and a new version of getID3 is available.

As a courtesy, the fixes are being backported where necessary to all branches eligible to receive security fixes, currently through 4.7. Backports are in progress and will ship as they become ready, but this does not replace the operational benefit of running the latest release line.

This 6.9.2 release is intentionally narrow. The next major release is version 7.0, planned for 9 April 2026, so teams should separate urgent patching work from any upcoming major-version testing tracks.

This release was led by John Blackbourn. It also included contributions from Dennis Snell, Alex Concha, Jon Surrell, Isabel Brison, Peter Wilson, Jonathan Desrosiers, Jb Audras, Luis Herranz, Aaron Jorbin, Weston Ruter, and Dominik Schilling.