WordPress 7.1.1

WordPress 7.1.1 lands on September 17, 2026. The official description is a defect-only maintenance release, which sounds easy to skip. The honest reading is different: this release exists because 7.1 shipped a compatibility break that knocked production sites offline.

Do Not Get Carried Away

The scope is genuinely narrow. A ticket qualifies only if the problem was introduced during the 7.1 cycle or was deliberately deferred at the end of it. No new features. That is the good news.

What Needs Watching

The problem at the center of this release is the hook callback key type change, tracked as Trac ticket #65919. As part of a performance improvement, 7.1 moved from spl_object_hash() to spl_object_id() for the internal ID of a registered hook callback. The new ID is cast to a string, but PHP converts a canonical decimal string back to an integer when it is used as an array key.

For callbacks that are a bare object, a closure or a class with __invoke(), the keys in WP_Hook callbacks became integers where they had always been 32-character strings. Any plugin that iterates those keys and runs a string function under strict_types gets a fatal TypeError on every request.

The proposed core fix prefixes the generated ID with a non-numeric string so PHP has nothing to coerce, and applies the same treatment to WP_Widget_Factory. Note the wording: the fix is reopened for merge consideration, so it is a candidate for 7.1.1, not a confirmed inclusion. The final ticket list ships with the release candidate announcement.

The Real Risk

Minor core updates install themselves by default. On most sites WordPress 7.1.1 will appear without anyone clicking anything. That is by design, and turning off minor auto-updates is the wrong move because it means missing security releases.

If you patched a site manually in August to work around the 7.1 crash, September is the month to remove that workaround and test it on staging before 7.1.1 auto-installs in production.