DIGITAL INTERACTIVE
WordPress 7.1 Arrives August 19: New Blocks, Enforced iFrame Editor, and What to Do Before It Lands
WordPress 7.1 is scheduled to release on August 19, 2026, timed to the closing day of WordCamp US in Phoenix. It is the second major WordPress release of 2026, following 7.0 in May, and it carries a set of changes relevant to site owners, developers, and anyone managing client sites. Before diving into what is new, there is one immediate action every WordPress operator should take.
Patch Now: WordPress 7.0.3 Is Out
On August 6, 2026, WordPress released version 7.0.3, a security release that addresses 12 vulnerabilities. The headline flaw is CVE-2026-64638, tracked as XSS2Shell by the security research team at pwn.ai. It is a pre-authentication reflected cross-site scripting vulnerability on the WordPress login screen that carries a CVSS score of 8.9 and requires zero account privileges to trigger.
The mechanics: when a non-existent username is submitted to wp-login.php, WordPress builds an error message that passes through wp_strip_all_tags() and then through WordPress’s own KSES sanitizer. A crafted string with a space after the opening angle bracket survives the first parser as plain text but is re-interpreted as live HTML by the second. That gives an attacker-controlled JavaScript execution point in the WordPress origin on every failed login page. If a logged-in administrator then clicks a single attacker-crafted link, the chain can reach Application Password theft, plugin upload, and PHP code execution on the server. Researchers at pwn.ai demonstrated multiple paths from the XSS to code execution, including variants that install a plugin or upload a ZIP file.
The flaw affects WordPress 6.4 through 7.0.2. The fix is in 7.0.3 and has been backported through the 4.7 branch. Sites with automatic background updates will receive the patch without manual action. Self-hosted sites need to update from the Dashboard or via WP-CLI. As of the disclosure date there is no evidence of active in-the-wild exploitation, but the full chain is known to researchers, so the window to patch before exploitation begins is narrow.
WordPress 7.1 RC2 includes all applicable security fixes from 7.0.3. The safest path forward is: update to 7.0.3 now, then plan a staged 7.1 upgrade after the release on August 19.
What Is Confirmed for WordPress 7.1
Responsive Styling and Interactive State Controls
This is one of the two headline features the 7.1 cycle was built around. Site owners and designers can now apply per-viewport block styles and hover, focus, and active state styling directly inside the Site Editor, without writing custom CSS. The fixed desktop, tablet, and mobile preview toggle has been replaced with a unified, freely resizable device preview introduced in Gutenberg 23.5. For sites that previously handled responsive overrides through a stylesheet or a third-party plugin, this change can eliminate a layer of maintenance.
Two New Core Blocks: Playlist and Tabs
A Playlist block ships confirmed in the beta builds. It collects audio files into a single player with optional waveform visualization, covering podcast and music use cases that previously required a plugin. A Tabs block is also confirmed. The Table of Contents block was on the original roadmap but has not appeared in the beta feature list.
Enforced iFramed Post Editor
The post editor now always runs inside an iframe. This is the change most likely to cause compatibility problems for sites with custom blocks or older plugins. The iframe isolates the editor canvas from admin styles so viewport units and media queries measure the canvas rather than the browser window. Blocks built on Block API version 2 or lower need to be updated to version 3. The block.json file for each block should contain at minimum "apiVersion": 3. WordPress publishes a block migration guide covering this transition.
Media Overhaul
WordPress 7.1 adds native support for HEIC and AVIF image formats, a new crop and rotate modal accessible without leaving the editor, and upload retry logic that resumes when a connection drops mid-transfer. Media Library infinite scrolling is also enabled by default in this release, with a per-user opt-out available.
Notes and Asynchronous Collaboration
Real-time collaboration did not make it into 7.1 (more on that below), but the Notes system received substantial investment this cycle. It supports comments, suggestion mode, rich text formatting, and emoji reactions, giving editorial teams an async review workflow without needing a third-party tool.
AI Client and Developer API Updates
The AI Client introduced in WordPress 7.0 gains streaming support for generation responses and embeddings support for semantic and vector search in 7.1. These remain developer-facing primitives. A new Guidelines feature for storing site knowledge as a wp_knowledge custom post type was also a candidate for 7.1 and may ship depending on where the merge proposal stands at feature freeze. The Abilities API introduced in 7.0 gains better querying, filtering, and input validation. The @wordpress/reusable-blocks package is deprecated and on a path to becoming a no-op.
What Did Not Make the Release
React 19
React 19 will not be in WordPress 7.1. The core team had originally planned to ship the upgrade from React 18 to React 19 in this release, and Gutenberg 23.3 briefly shipped with it enabled in early June. Within 48 hours, plugin crashes were appearing across production sites. When a plugin bundles its own copy of react and react/jsx-runtime, the elements it creates have a shape that React 19 actively rejects. The result was hard crashes at render time, admin screens white-screening, and blocks failing to load. The core team reverted in Gutenberg 23.3.2 and published a revised plan on July 24, 2026.
React 19 is now an experimental flag in Gutenberg 23.4 and later. Plugin developers who ship compiled JSX, use @wordpress/element, or touch editor internals should enable the flag under the Gutenberg Experiments screen on a staging site to find and fix incompatibilities before the upgrade lands in a future core release. The concrete action: stop bundling your own React in plugin builds and use @wordpress/element as the canonical React surface instead.
Real-Time Collaboration
For the second consecutive major release, real-time collaboration is absent. It was pulled from WordPress 7.0 two weeks before that release and does not appear in the 7.1 beta announcements. The 7.1 roadmap is candid about the reason: unresolved strategic questions around storage mechanism and scope remain open. Notes received the collaboration investment this cycle instead. The next opportunity on the roadmap is WordPress 7.2, scheduled for December 10, 2026.
Preparing Your Site for the August 19 Release
For most production sites running established plugins and themes, the recommended approach is to wait roughly one to two weeks after August 19 for plugin authors to ship 7.1-compatible releases, then test on a staging environment before pushing to production. Sites with complex JavaScript-heavy plugins or custom blocks on Block API v2 carry the highest compatibility risk and should be tested earliest.
Steps to take now:
- Update to WordPress 7.0.3 immediately to apply the CVE-2026-64638 XSS2Shell patch.
- Install the Gutenberg plugin on a staging site and enable the React 19 experiment flag to identify console warnings from custom blocks or plugins before the upgrade is mandatory.
- Check all custom block.json files and confirm
"apiVersion": 3is set in each one. - Review plugin changelogs for 7.1-compatible release notes before updating production.
- Take a tested, restorable backup from a clean state before any major upgrade. A backup that has never been restored is not verified.
- Enable automatic background updates on all sites to receive future security patches without a manual step.
Frequently Asked Questions
When does WordPress 7.1 release?
August 19, 2026, timed to the closing day of WordCamp US in Phoenix. That is also the day RC2 candidates and the dry run lead into.
Is React 19 included in WordPress 7.1?
No. React 19 was reverted on July 24, 2026 after plugin interoperability issues were found. WordPress 7.1 continues on React 18.3. React 19 remains an experimental opt-in in the Gutenberg plugin and is targeted for a future core release.
What is the enforced iframed editor and what breaks?
The post editor now always runs inside an iframe in 7.1. Blocks on Block API version 2 or lower need to be updated to version 3. Check block.json for the apiVersion field. WordPress publishes a migration guide for the transition.
Does WordPress 7.1 include real-time collaboration?
No. Real-time collaboration was removed from 7.0 before that release and is not in 7.1 either. The async Notes system shipped instead.
Should I update to 7.0.3 before 7.1 releases?
Yes. WordPress 7.0.3 patches CVE-2026-64638, a high-severity pre-auth XSS that can escalate to PHP code execution. Update immediately rather than waiting for 7.1.
Sources:
- WordPress 7.1: What to Expect (Releasing August 19, 2026)
WordPress 7.1 is due August 19, 2026, timed to the last day of WordCamp US. The biggest change: responsive styling and interactive states (hover, focus, active) become editor controls. Two new blocks are confirmed in beta: Playlist and Tabs. - WordPress 7.0.3 Security Release – WordPress News
WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. - New WordPress Pre-Auth XSS Could Lead to PHP Code Execution – Patch ASAP
Tracked as CVE-2026-64638 (CVSS score: 8.9), the high-severity vulnerability requires no attacker privileges. The login-page XSS requires no authentication. The code-execution path requires a victim already logged in as an Administrator and explicit interaction with an attacker-controlled page. - XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638)
Pwn discovered a critical pre-auth XSS to RCE vulnerability chain affecting all versions of WordPress Core. An estimated 500 million+ websites were vulnerable until today. - WordPress XSS2Shell: Unauthenticated Login-Screen XSS to PHP Code Execution (CVE-2026-64638)
The flaw, discovered and named XSS2Shell by pwn.ai, lets an unauthenticated attacker inject attacker-chosen DOM into the login screen with a single failed login and drive WordPress's own JavaScript into script execution in the site's origin. - WordPress 7.0.3 Released: 12 Vulnerabilities Found and Fixed
The headline vulnerability is a reflected XSS on the login screen, reachable without any authentication and with the potential to lead to PHP code execution (CVE-2026-64638). Patchstack deployed RapidMitigate rules for the high-risk vulnerabilities immediately. - React 19: Punted Beyond WordPress 7.1, Experiment in Gutenberg
React 19 upgrade won't be a part of WordPress 7.1. After briefly enabling it in Gutenberg we discovered unexpected incompatibilities in how old and new version of React interact with each other, and in the ways how plugins use React, and we were forced to revert the change. - WordPress 7.1: Release Date, Features and What's Deferred
Release date: 19 August 2026. Key features: Introduction of native responsive styling and pseudo-state controls in the Site Editor, asynchronous team collaboration via enhanced Notes, native media organisation and a new media editor modal. - WordPress 7.1 Roadmap: Release Date, Features and What's Deferred
The React 18 to React 19 upgrade has been punted beyond 7.1. Real-time collaboration was pulled from WordPress 7.0 two weeks before that release and is not in 7.1 beta announcements either. - What's New for Developers (July 2026)
The final release is scheduled for August 19, 2026, timed with WordCamp US. Beyond the items detailed below, the Roadmap to 7.1 lists pseudo-state styling, new Playlist, Table of Contents, and Tabs blocks, an enforced iframed editor for block themes.
Sources:
- WordPress 7.1: What to Expect (Releasing August 19, 2026)
- WordPress 7.0.3 Security Release – WordPress News
- New WordPress Pre-Auth XSS Could Lead to PHP Code Execution – Patch ASAP
- XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638)
- WordPress XSS2Shell: Unauthenticated Login-Screen XSS to PHP Code Execution (CVE-2026-64638)
- WordPress 7.0.3 Released: 12 Vulnerabilities Found and Fixed
- React 19: Punted Beyond WordPress 7.1, Experiment in Gutenberg
- WordPress 7.1: Release Date, Features and What's Deferred
- WordPress 7.1 Roadmap: Release Date, Features and What's Deferred
- What's New for Developers (July 2026)
