WordPress is returning to a three-major-release-per-year model in 2026, and while the community settles into that rhythm, the first maintenance release after the autumn core update is already taking shape. WordPress 7.1.1 is scheduled as a bug-fix-only release for September 17, 2026, with RC1 landing September 10. At the same time, the community is discussing a notable addition for version 7.2 — a built-in Secrets API meant to finally solve secure storage of API keys and credentials right in core.
What WordPress 7.1.1 brings
This is a typical maintenance release — no new features, just a set of fixes for bugs that surfaced after 7.1 shipped. The team is looking for volunteers to serve as release manager for the entire 7.1.x line, with the window for 7.1.1 set between September 1 and 24. For site owners, this means one practical thing: once the update lands, roll it out within days rather than months — maintenance releases often quietly address minor security issues even when not flagged as a critical patch.
Secrets API — a security upgrade on the horizon
The more interesting story is the longer-term outlook. At the September 2 developers chat, the team discussed a Secrets API proposal for version 7.2 — a standardized way for plugins and themes to securely store sensitive data such as API keys, tokens, or third-party service credentials. Until now, every plugin has handled sensitive data storage its own way, often as plain text directly in the database, which has long been one of the ecosystem’s quiet security risks. A unified core API should make encryption the standard rather than an exception dependent on any given plugin’s quality.
Tied to improvements in vulnerability disclosure
The same discussion also covers changes to the program through which newly discovered vulnerabilities in WordPress core and the plugin ecosystem get reported. The goal is to shorten the time between a bug report and a fix, and to make communication toward site operators clearer — exactly what determines, in practice, how quickly a site moves from exposed to patched once a new CVE goes public.
What this means for your site
If you manage your own WordPress site, watch for the 7.1.1 release in mid-September and deploy it without unnecessary delay — there’s practically no reason to wait on maintenance releases, since compatibility risk is minimal. Tracking the Secrets API matters most if you use plugins that talk to external APIs (payment gateways, mapping services, AI tools) — once the API lands in core, that’s a signal the plugin should migrate to the standard, and it’s worth asking your plugin vendor about the timeline.
Back to three major releases a year
The shift in release cadence — back to three major versions instead of two — is meant, according to the development team, to allow better planning for agencies and plugin developers alike. Instead of unpredictable jumps between versions, this creates a steadier rhythm that’s also planned to align with key community events throughout the year. For site operators, this practically means testing plugin and theme compatibility after each major release more often, but in smaller, more predictable batches — which, from a maintenance standpoint, is usually easier to handle than one big, risky release per year.
Why the Secrets API is good news for smaller sites too
At first glance, the Secrets API might sound like a topic mainly for large projects with dozens of integrations, but it affects an ordinary business site or small online store just as much. Practically every site today connects to at least one external service — a payment gateway, an email newsletter tool, or a map on the contact page — and these connections are often the weakest link if a plugin stores credentials unencrypted. Once secure storage becomes a standard part of core, security quality will stop depending on whether a particular plugin’s author bothered to add encryption on their own.
Conclusion
WordPress keeps pursuing a strategy of regular, predictable releases while also tackling a long-deferred security debt around storing sensitive data. Don’t want to track exactly when to update core and which plugins to watch ahead of the coming Secrets API? Set up regular site maintenance with us — we’ll keep an eye on updates and security checks for you.
