A WordPress security update is not one you can leave for later this month. WordPress released two security updates in two weeks, 7.1.2 on 22 September and 7.1.3 on 6 October 2026. WooCommerce 11.2 followed on 7 October, and Singapore’s Cyber Security Agency (CSA) says one of the WordPress flaws is reportedly being actively exploited. The answer is to update now, but to do it safely, because a broken checkout just before 11.11 also costs sales. Brands Win, a Singapore-based agency that builds WordPress and WooCommerce sites for consumer brands, suggests the routine below.

Checked against WordPress.org, WooCommerce and CSA Singapore, 14 October 2026.

What changed: the September and October 2026 security releases

WordPress 7.1.2 (22 September 2026). The WordPress 7.1.2 release post (22 September 2026) says it “features a fix for a critical severity security vulnerability”. WordPress explains that “an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories.” If the server and active theme conditions are met, “this can lead to remote code execution (RCE)”. The flaw is tracked as CVE-2026-87902.

CSA alert (24 September 2026). The CSA alert on active exploitation (24 September 2026) opens: “Attackers are exploiting a high-severity vulnerability in WordPress to achieve remote code execution under specific conditions. Patch immediately.” CSA gives it a CVSS v3.1 score of 8.1 out of 10 and says it “affects WordPress versions prior to 7.1.2”. It adds that the flaw “is reportedly being actively exploited, and a proof-of-concept exploit is publicly available.”

WordPress 7.1.3 (6 October 2026). The WordPress 7.1.3 release post (6 October 2026) “features 7 security fixes and 4 bug fixes”. Two examples in plain English: a stored cross-site scripting issue on the Comments admin page, and a way for people who are not logged in to see comments on private and unpublished posts. WordPress says “it is recommended that you update your sites immediately.”

WooCommerce 11.2 (7 October 2026). The WooCommerce 11.2.0 release notes (7 October 2026) say: “WooCommerce 11.2 includes security fixes. Update all stores to 11.2.” The release needs a database update. WooCommerce also warns that PublishPress Future versions 3.0.0 to 4.10.3 “can cause a fatal error on sites running WooCommerce 11.2”, so update that plugin to 4.10.4 or later first. Two days later, WooCommerce 11.2.1 (9 October 2026) fixed classic checkout on stores that remove address fields, which on 11.2.0 “could see checkout blocked”, have tax not charged or lose shipping options.

Why a WordPress security update matters for Singapore consumer brands

A consumer brand’s website holds customer accounts, orders and, on a WooCommerce store, the checkout that pays for your campaigns. An exploited site can be defaced, made to redirect visitors or taken offline while it is cleaned up, possibly in the middle of a sale.

A hacked or broken site can also lose visitors’ trust and the search visibility you have built, so security belongs in your SEO routine too.

Staying on an old version is not safe either. WordPress notes in its 7.1.3 post that “only the most recent version of WordPress is actively supported”. The simplest position before 11.11 and 12.12 is the latest release, with WooCommerce, your theme and plugins kept current.

How to check your version and what updates automatically

Go to Dashboard > Updates to see your WordPress version and any waiting updates. If you see anything older than 7.1.3, the latest release, treat it as urgent.

Next, work out what updates by itself. WordPress’s Updating WordPress guide (last updated 15 September 2024) says: “Most sites are now able to automatically apply these updates in the background”, meaning minor and security releases. It adds: “You’ll still need to click ‘Update Now’ for major feature releases.” Your site may already be on 7.1.3, but check rather than assume.

Plugins and themes work differently. The plugin and theme auto-updates guide (last updated 13 January 2023) explains that administrators opt in theme by theme and plugin by plugin. Once switched on, “By default WordPress runs auto-updates twice per day”, and WordPress emails the site owner about the results. These updates “rely on WordPress Cron tasks”, so if they seem stuck, go to Tools > Site Health and look for errors.

Some hosts switch automatic updates off or manage them, so check with your host and make sure the update emails reach someone who reads them.

A safe update routine for WooCommerce stores

WooCommerce’s guide on how to update WooCommerce (read 14 October 2026) sets out the steps. Here is the order we follow:

1. Back up both halves of the store. WooCommerce says a store keeps data in the wp-content folder (themes, extensions and uploads) and in the database (products, orders, pages and settings). Back up both.
2. Test on a staging site. A staging site is a copy of your live site. WooCommerce is direct: “Do not test updates directly on your production site.”
3. Update everything together on staging. Update WooCommerce, extensions, payment gateways and the theme as one set, and check each one’s “Tested up to” WooCommerce version.
4. Test the workflows that earn money. Check product pages, cart, checkout, payments, shipping, taxes and order emails, plus any features your store relies on.
5. Update the live store in Coming soon mode. WooCommerce suggests Coming soon mode “so customers do not check out while files and database changes are running.” Update, run the database update if WooCommerce asks for one, then place a test order before you reopen.
6. Have a way back. If something breaks, keep customers away from checkout and restore from your backup rather than fixing it live.

On timing, WooCommerce says “A monthly cadence works well for most stores”, and to “Update sooner than your regular schedule if a release includes a security fix or resolves broken functionality your store depends on.” That is the case for this month’s releases.

If your store needs a staging site or a cleaner setup, our page on WooCommerce ecommerce websites covers how we build them.

Planning around 11.11, 12.12 and WordPress 7.2

Sale weeks raise the stakes both ways: you cannot afford a hacked site or a broken checkout. So treat security and feature releases differently.

Security releases: apply them promptly, even close to a sale, after a quick staging test of checkout and payments.

Feature releases: schedule them outside the sale weeks. The WordPress 7.2 schedule (last modified 6 October 2026) lists Beta 1 on 20 October 2026 and the release on 8 December 2026, four days before 12.12. WordPress says 7.2 “will be the final major release of 2026”.

Our recommendation, not WordPress’s: test WordPress 7.2 on staging once it is out, but hold the live update until after 12.12, unless a security fix makes it necessary sooner. Any 7.2.x security release should still go through the quick routine above.

Keep a short freeze calendar: the dates you will not change themes, plugins or checkout settings, and who signs off security fixes.

Who should own updates

Updates slip when nobody owns them. Write down:

• Owner: the person, in-house or at your agency, who applies and tests updates.
• Cadence: a monthly check, plus same-week action on security releases.
• Backups: where they are kept, how often they run and who has tested a restore.
• Alerts: who receives the WordPress auto-update emails and the host’s notices.

Your WordPress admin, hosting account and backups should stay in your business’s name, even when an agency does the work. At Brands Win, site fixes like these are sequenced as part of Growth System 90, so security and checkout checks come before new campaigns. For new builds and redesigns, see our web design page.

FAQs: WordPress security updates