WordPress Weekly: Core, WooCommerce and Security Updates — 21 September 2026

WordPress WeeklySecurityWooCommerce

By Web Wonderland ·

A protected website dashboard connected to update, ecommerce, plugin and server monitoring panels

This week's WordPress priorities are clear: install the WordPress 7.1.1 security release, update WooCommerce, check whether one actively exploited wholesale plugin is present, and ask the right hosting question about HEIC image processing.

This roundup turns the most important WordPress security and platform news into practical actions for website owners, agencies and in-house teams. It was checked on 21 September 2026; versions and threat information can change after publication.

If you manage several sites, work from an inventory rather than memory. Record the WordPress, WooCommerce, plugin and PHP versions in use, the hosting environment, who owns each licence and when the site was last backed up and tested.

The week's WordPress updates at a glance

  • Act now: WordPress 7.1.1 is a security and maintenance release containing 11 security fixes.
  • WooCommerce: version 11.1.1 includes security improvements to API permissions, authentication and guest-session validation.
  • Check your plugin list: WooCommerce Wholesale Lead Capture versions up to and including 2.0.3.1 are affected by a critical file-upload vulnerability that Wordfence reports is being actively exploited.
  • Ask your host: a critical libheif vulnerability may affect some servers that process HEIC images. This is a system-library update, not a normal WordPress plugin update.

The first two items are routine but important update work. The final two need a more specific response: confirm whether the affected component exists before deciding what to do.

1. WordPress 7.1.1 is the priority core update

WordPress 7.1.1 was released on 17 September with 17 Core bug fixes, 19 Block Editor fixes and 11 security fixes. WordPress recommends updating sites immediately because it is a security release.

The security work covers several different areas, including stored cross-site scripting, authorisation and capability checks, post handling, template paths and information disclosure. That breadth matters: there is no single feature switch that substitutes for applying the release.

Before updating a business-critical site, confirm that a current backup can be restored and note any custom code or sensitive integrations. Apply the update, clear the appropriate caches, then test the public website and the journeys that generate revenue or enquiries. On an ecommerce or membership site, that should include login, checkout and account functions rather than only the homepage.

WordPress says compatible sites with automatic background updates will begin the process automatically. Do not assume this has happened: verify the installed version and the result on each site you manage.

2. WooCommerce 11.1.1 strengthens API and session handling

WooCommerce 11.1.1 was released on 18 September. Its official release notes describe improvements to REST API authentication, legacy API permission checks, mobile-app login and guest-session validation. It also corrects a Mini-Cart styling problem when visibility rules hide the block.

The WooCommerce team classed the security issues as lower risk and requiring privileged administrator access. That context is useful, but it is still a security update. Plan the update promptly and test the parts of the store that depend on sessions and integrations.

A proportionate check covers guest and logged-in checkout, payment hand-off, confirmation emails, the Mini-Cart, customer accounts and any external system using WooCommerce API credentials. The release does not require a database update, according to the official notes.

3. Check for WooCommerce Wholesale Lead Capture now

This item is urgent only for sites using the specific premium plugin WooCommerce Wholesale Lead Capture. Wordfence reports that versions up to and including 2.0.3.1 contain an unauthenticated arbitrary file-upload vulnerability, identified as CVE-2026-27540. The patched version at the time of its report is 2.0.3.2.

Wordfence says it has blocked more than 100,000 exploit attempts. The flaw can allow an attacker to upload a PHP file and may lead to remote code execution or full site compromise.

If the plugin is installed, take the site out of guesswork mode:

  1. Confirm the exact installed version and whether the plugin is active or dormant.
  2. Preserve appropriate evidence and a current backup before making changes.
  3. Update to the vendor's current patched release through a trusted source.
  4. Review administrator accounts, recently changed files, scheduled tasks and security logs for signs of compromise.
  5. Rotate relevant credentials if an investigation indicates that the site or server may have been accessed.

Updating closes the known vulnerable code path; it does not prove that a previously exposed site is clean. If the plugin is not in your inventory, this particular vulnerability does not apply.

4. The libheif issue sits below WordPress

The week's most useful trend is that WordPress security does not stop at Core, themes and plugins. Wordfence disclosed a critical heap-buffer-overflow issue in libheif, a system library that some servers use when processing HEIC or HEIF images.

The Wordfence technical report says affected builds from 1.18.0 to 1.23.2 can be vulnerable, with the issue fixed upstream in 1.23.3 and further security fixes in 1.23.4. Exposure also depends on how the library was compiled and whether the server's image-processing path accepts the affected formats.

There is no WordPress plugin update for this. Managed-hosting customers should ask their provider whether the site's image-processing stack is affected and whether the fixed operating-system package has been applied. Container users may need to rebuild and redeploy from an updated base image; merely restarting an old image does not refresh its packages.

WordPress Site Health can show whether ImageMagick reports HEIC support under Tools → Site Health → Info → Media Handling. That is a useful clue, not a complete vulnerability test. Your host is better placed to confirm the library version, build options and patch status.

The wider trend: maintenance is a chain, not an update button

Together, these stories show four layers of modern WordPress maintenance: Core, commerce software, premium plugins and the server libraries beneath the CMS. A dashboard with no red update badges can still need attention at another layer.

Good maintenance therefore combines an accurate software inventory, valid premium-plugin licences, backups, monitored updates, hosting communication and functional tests. Security scanning can add evidence, but it does not replace patching or checking the journeys customers actually use.

The answer is not to delay every update until a perfect test window appears. Security releases need a prompt response. The practical approach is to make safe updating routine: know the estate, keep a recoverable backup, use staging where the site's complexity warrants it, and have a concise regression checklist ready.

A practical WordPress checklist for this week

  1. Inventory: confirm every site's Core, WooCommerce, theme and plugin versions, including inactive and premium plugins.
  2. Back up: verify that files and the database are covered and that the restore route is understood.
  3. Update Core: move supported sites to WordPress 7.1.1 and confirm the installed version.
  4. Update WooCommerce: move stores to the current 11.1 maintenance release, then test checkout, accounts, emails and integrations.
  5. Search the estate: identify any installation of WooCommerce Wholesale Lead Capture and follow the vendor and security guidance immediately.
  6. Ask the host: where a site processes HEIC or HEIF uploads, request confirmation of the libheif patch status and affected services.
  7. Test outcomes: verify forms, purchases, logins, search, scheduled jobs and other business-critical journeys.
  8. Record the result: note what changed, who checked it, any follow-up action and the rollback point.

What we will watch next

WordPress 7.1.1 is a short-cycle release and WordPress currently plans version 7.2 for December. In the nearer term, we will watch for follow-up Core and WooCommerce releases, changes to active exploitation, vendor guidance for affected plugins and hosting-provider responses to the libheif issue.

Future weekly roundups will continue to separate broad action from component-specific risk. A serious vulnerability in a plugin you do not use should not distract from a less dramatic update that applies to every site in your care.

Need help checking or updating a WordPress site?

Web Wonderland provides WordPress maintenance and support in Essex for businesses that want updates, testing and ongoing technical oversight. If an update has exposed a defined fault, our WordPress Fix Desk offers fixed-scope diagnosis and repair.

Do not send passwords or access credentials through an enquiry form. Start with the website URL, the versions or warning involved, what you have observed and the business impact; secure access can be arranged after the scope is understood.

Sources and publication note

This article is general technical information, not a guarantee that a site is secure. Check current vendor guidance and the details of your own software and hosting environment before acting.

Share:
Get in Touch