Table of Contents
Why did WordPress 6.9.3 come out immediately after the 6.9.2 update?
Rapid Release Cycle
WordPress released version 6.9.2 on March 10, 2026, as a critical security patch. Site owners should apply this maintenance update immediately to secure their platforms. This specific version will experience a short lifecycle. The core development team plans to launch WordPress 7.0 on April 9, 2026, during WordCamp Asia. Websites with automatic background updates enabled will handle this transition smoothly without manual administrative intervention.
Critical Security Patches
The 6.9.2 release directly mitigates multiple security vulnerabilities across the core platform. The update successfully resolves the following specific issues:
- A blind SSRF vulnerability reported by sibwtf and other security researchers.
- A PoP-chain weakness within the HTML API and Block Registry identified by Phat RiO.
- A regex DoS weakness involving numeric character references found by Dennis Snell.
- A stored XSS vulnerability present in navigation menus discovered by Phill Savage.
- An AJAX query-attachments authorization bypass reported by Vitaly Simonovich.
- A stored XSS via the data-wp-bind directive located by kaminuma.
- An admin area XSS allowing client-side template overrides reported by Asaf Mozes.
- A PclZip path traversal issue found independently by Francesco Carlucci and kaminuma.
- A Notes feature authorization bypass identified by kaminuma.
- An XXE vulnerability in the external getID3 library reported by Youssef Achtatal.
Theme Compatibility Fix
Less than 24 hours after launching 6.9.2, the core team released WordPress 6.9.3 to correct a breaking bug. The previous security patch disrupted certain themes that use an unsupported stringable object mechanism to load template file paths. The template_include filter strictly requires a standard string to function correctly. The development team issued the 6.9.3 fast-follow release specifically to restore front-end operations for these broken sites. Administrators experiencing display issues must update to version 6.9.3 immediately to bring their websites back to an operational state.