WordPress 7.1, code-named “Mary Lou,” officially released on August 19, 2026, following a release candidate on August 5. It’s a feature release rather than a security release — but “not a security release” doesn’t mean “skip it,” and the timing of this update is worth understanding, especially against everything else that happened in WordPress security this same week.
What’s actually new in 7.1
The release itself is substantial: WordPress.org’s own release notes count more than 145 individual updates and fixes since the final beta, split roughly between 57 changes in the block editor and 88 in WordPress core.
On the editor side, the headliners are a new Icons API that lets themes and plugins register icon collections in a standard way, email notifications when someone @mentions you in a block-level Note, shareable revision links for reviewing draft changes with a client or teammate without giving them full editor access, a redesigned Tabs block with reordering controls, and shift-click range selection in DataViews (the interface behind the Site Editor’s list views).
On the core side, the more technical but genuinely useful changes include configurable speculative loading — letting site owners tune how aggressively WordPress preloads likely-next-pages via environment variables — REST API request preloading when the editor loads, an updated jQuery UI library (1.14.2), native autofocus support for dialog elements, and enforced upload limits per site on multisite networks.
Should you update right away?
For most well-maintained WordPress sites, yes — but “right away” doesn’t have to mean “the same afternoon it’s released.” A sensible approach for a feature release like this one is to update a staging copy of your site first, click through your key pages and any custom functionality your theme or plugins rely on, and then push the update to production within the next few days once you’ve confirmed nothing broke. That’s a different pace than a genuine security patch deserves, which is closer to “update today.”
The one thing worth avoiding is treating this release as optional indefinitely. WordPress only actively supports recent core versions with full patches, and every major release you skip widens the gap between what you’re running and what the security team is actively testing against. Falling multiple versions behind is one of the most common things we find during a website security and maintenance review — and it’s one of the easiest things to prevent.
Why “just a feature release” still matters for security
Here’s the connection that’s easy to miss: this same week also saw a critical, unauthenticated remote-code-execution vulnerability disclosed in Elementor Pro (more on that below), and Wordfence’s own quarterly data shows plugin vulnerability disclosures running well ahead of last year’s pace. None of that is a WordPress core problem — but it’s a reminder that a site’s security posture is only as strong as its least-current component. A site running the latest WordPress core but a six-month-old version of a page builder plugin isn’t meaningfully more secure than one that’s behind on everything; the vulnerable piece is still there. Staying current on core is one part of a habit that has to cover your whole stack, not a checkbox you tick once a year.
If keeping every part of your site — core, theme, and plugins — updated on a real schedule isn’t something you have time to manage yourself, that’s exactly what our ongoing website maintenance service handles, including testing updates before they go live on your production site.
FAQ
Do I need to do anything, or does WordPress update itself automatically? Minor WordPress releases (like 7.0.1, 7.0.2) usually apply automatically on most hosts. Major feature releases like 7.1 typically require a manual click to update unless you’ve specifically enabled automatic updates for major versions, which many site owners choose not to do because of the higher chance a big release changes something a plugin or theme depends on.
Will WordPress 7.1 break my plugins or theme? Most well-maintained plugins and themes are tested against release candidates before launch, so major breakage is uncommon. It’s not zero-risk, though, which is why testing on a staging copy first — rather than updating production directly — is the safer habit for a release this size.
Is WordPress 7.1 a security update? No — it’s a feature release, not a security patch. That said, running an outdated core version is still a security risk over time, since WordPress’s active patching focus shifts toward more recent releases.