On October 28, 2026, WordPress 4.7.39 was released to the public.
Installation/Update Information
To get this version, update automatically from the Dashboard > Updates menu in your site’s admin area or visit https://wordpress.org/download/releases/.
For step-by-step instructions on installing and updating WordPress:
If you are new to WordPress, we recommend that you begin with the following:
- Get Started With WordPress
- First Steps With WordPress or Upgrading WordPress Extended
- WordPress Courses
Summary
Security updates
This release features several security fixes. Because this is a security release, it is recommended that you update your sites immediately.
The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:
- A hardening fix for unescaped usernames on the multisite Network Users screens reported by Anthropic
- A race condition during core updates that could lead to remote code execution reported by Umut Bayram
- An update to the bundled root certificates due to the eMudhra revocation.
Change log
List of files revised
/wp-admin/includes/ajax-actions.php
/wp-admin/includes/class-wp-ms-users-list-table.php
/wp-admin/includes/class-wp-upgrader.php
/wp-admin/includes/class-wp-users-list-table.php
/wp-admin/includes/ms.php
/wp-admin/includes/update-core.php
/wp-admin/user-edit.php
/wp-admin/users.php
/wp-includes/admin-bar.php
/wp-signup.php
List of packages revised
No package was revised.