WordPress 7.1.2 patches an unauthenticated path traversal in page template resolution that can become remote code execution. Which themes and servers are exposed, how to prove a site is patched, and how to update safely, including Composer and Docker.
WordPress 7.1 adds a unified public exposure flag and a shared filtering pipeline to wp_get_abilities(). The resolution order, the two callbacks, the two global filters, the REST metadata trap, and why filtering is discovery and not authorisation.
The iframed post editor becomes unconditional in WordPress 7.1. In 7.0 a single legacy block in your test post switched the iframe off, which means many blocks were never actually tested in it.
WordPress 7.1 adds wp_prepare_json_schema_for_client(), turning internal schemas into portable draft-04 output. What it strips, the two profiles, and the Abilities API changes that ship alongside it.
The Custom HTML block can now interleave static markup with real, editable inner blocks that are locked in place. The markup pattern, the innerContent variation field, a legacy conversion walkthrough, and where this beats a pattern or a custom block.
The WordPress Icons API in 7.1 turns the built-in icon set into a public registry. The registration functions, wp_get_icon(), REST routes, what the SVG sanitizer strips, and a five-stage migration plan.
WordPress 7.1 ships jQuery UI 1.14.2 and four functions disappear. What moved, the compatibility flag core flips for you, and a 20 minute audit.
WordPress 7.1 adds four filters around the Abilities API execution pipeline, so you can short-circuit a call, enrich its input, override the permission result, or transform what comes back. What each one is, where it fires, and the patterns that matter once an AI agent is the caller.
WordPress 7.1 was going to move the block editor to React 19. It is not. Core enabled it in Gutenberg, hit interop problems with plugins and reverted, so 7.1 ships on React 18.3. What happened, what it means if you already migrated, and the change that is now the real compatibility risk.
Gutenberg 23.5 replaces the desktop, tablet and mobile toggle with a freely resizable preview, and useResizeCanvas is deprecated and non-operational. What to migrate to, plus the layout changes shipping alongside.
All 330 icons in @wordpress/icons v15 declare fill=currentColor, so tinting with the CSS fill property stops working the way you expect. What breaks, how to find it, and what the new Icons API is building toward.
The __next40pxDefaultSize prop is now a no-op across roughly twenty components in @wordpress/components, and 40 pixel controls are permanent in WordPress 7.1. How to find every call site, fix the layouts that assumed the old size, and test before 19 August.
WordPress 7.1 Beta 1 landed July 15, with the final release August 19. What is in it - AI tooling, collaboration, responsive design, media, and an enforced iframed editor - and exactly how to test your plugins and themes before release day.
WordPress 7.1 was going to move the block editor from React 18 to React 19. It does not: core hit interop problems and reverted, so 7.1 ships on React 18.3. The migration is deferred, not cancelled, and the work to prepare your blocks is unchanged.