WordPress 6.9.4 was released on March 11, 2026, one day after 6.9.2 and 6.9.3. The WordPress Security Team found that not all of the security fixes in 6.9.2 had been fully applied, so 6.9.4 ships the necessary additional fixes.
Security fixes in this release
According to the official announcement, 6.9.4 completes the fixes for these issues:
- A PclZip path traversal issue
- An authorization bypass on the Notes feature
- An XXE in the external getID3 library
Because this is a security release, the recommendation is to update your sites immediately.
How to update
Sites that support automatic background updates receive it on their own. You can also update from Dashboard, then Updates, then Update Now, or download the release from WordPress.org.
Making sure every site lands on WordPress 6.9.4
Three releases in two days can feel like a lot, but the goal is simple: every site should end up on 6.9.4. If a site updated to 6.9.2 or 6.9.3 and then stopped, it is not fully protected. We check the reported WordPress version on every site we manage instead of assuming automatic updates ran.
The PclZip and getID3 fixes relate to handling uploaded zip and media files, so sites that accept uploads from many users or run membership and community features should be a priority.
PclZip path traversal, completed. This finishes the PclZip fix started in 6.9.2, so a crafted zip file can no longer write files outside the folder it belongs in. On sites we manage, we confirm the reported version is 6.9.4, then install a plugin from a zip file on staging to make sure uploads still work.
Notes authorization bypass, completed. The permission fix for Notes is now complete, which matters for teams that keep editorial feedback in Notes. We repeat the role by role Notes check from 6.9.2 after this update, so we know the full fix is in place and nothing changed for your editors.
getID3 XXE, completed. This completes the protection against crafted audio and video files. Podcast, membership and community sites that let users upload media are our first priority, and we upload a few real media files after updating to confirm they still process and play.
Want WordPress 6.9.4 and every release after it handled for you? Our support and maintenance plans cover tested core, theme and plugin updates, uptime monitoring and help when something breaks. Questions about your site? Contact us and we will take a look.
