What actually happened
On 17 September, WordPress released version 7.1.1, fixing eleven separate security issues in its core software. Then, just five days later on 22 September, it released 7.1.2 to fix a completely different and more serious flaw — one that let attackers reach files they should never have been able to touch, on some servers going as far as running their own code on your site. Security researchers recorded the first real attacks less than a day after the fix was announced, and by the following morning attempts were being logged in the dozens.
None of that is meant to frighten you. It’s meant to make a simple point: when a fix like this comes out, the gap between “patch available” and “attackers using it” can now be measured in hours, not weeks. Waiting to update “when you get a minute” isn’t really an option any more — which is exactly why automatic updates matter so much.
What “automatic updates” actually covers
WordPress has offered automatic background updates for its core software for years, and for most sites they’re switched on by default for minor releases (the 7.1.1-to-7.1.2 kind) without anyone needing to do anything. That’s the safety net that quietly protected a lot of site owners this month.
What it doesn’t always cover, by default, is everything else running on your site: your theme, and the plugins that add features like contact forms, bookings, or your online shop. Those often need updating separately, and on a lot of sites that still means someone logging in and clicking “update” by hand – which is exactly how sites end up running months-old, vulnerable versions of popular plugins without anyone noticing.
How to check your own site
If you or someone on your team manages your WordPress site directly, this takes about two minutes:
1. Log in to your WordPress dashboard and go to Dashboard > Updates.
2. Check whether WordPress itself shows as up to date, and whether it says automatic updates are enabled for core.
3. Scroll down to the Plugins and Themes sections on that same page and see if anything is flagged as needing an update. If a list appears here, those items are not updating themselves – they’re waiting for someone to act.
4. If you want plugins and themes to update automatically too, most of them let you switch this on individually from the Plugins page, next to each one’s name.
If your site was built and is looked after by a web designer, developer or agency, it’s worth simply asking them: “Are updates on my site automatic, and if not, who checks for them and how often?” It’s a completely reasonable question, and a good one should have a clear answer.
Why some sites can’t just switch it on
Automatic updates aren’t always the right default for every business. A site with a lot of custom-built functionality, or one where a plugin update has broken something in the past, sometimes needs a human to check that an update won’t cause problems before it goes live. That’s a fair trade-off — but it only works if someone is actually doing that checking on a regular schedule, rather than updates simply being left switched off and forgotten about, which is how a lot of sites end up exposed for months at a time.
The practical takeaway
You don’t need to follow every WordPress security story to keep your site safe. You need one thing to be true: something, or someone, is checking for updates and applying them promptly, every time, without you having to remember. For core WordPress, that’s often already happening automatically. For plugins and themes, it’s worth finding out for certain rather than assuming.
Not sure your site is covered?
If you’d rather not be the one checking the Updates screen every week, our WordPress Maintenance service keeps your core, themes and plugins patched as soon as fixes come out – including checking that nothing breaks when they do – so a week like this one doesn’t need your attention at all.
