WordPress 7.1 took sites down — not a CVE, a plugin crash

Quick reality check: WordPress 7.1 “Mary Lou” shipped on 19 August 2026. This is not a security drop like 7.0.4. It is a feature release — and on a chunk of VPS sites the only thing left was “There has been a critical error on this website”. Not because core is broken. Because plugins treated hook IDs as strings, and 7.1 made them integers.

WP Rocket (through 3.23.2.1) and WP Activity Log (5.6.5) are the well-known cases. Rocket shipped 3.23.2.2 on 20 August. Activity Log followed with 5.6.6. If 7.1 arrived via auto-update with no staging, a lot of people could not even open wp-admin.

What happened

WordPress changed how it builds hook callback IDs: performance, spl_object_id instead of a hash. Core is fine with that. Plugins that run those keys through substr() or strtolower() and expect a string throw a PHP 8 fatal — on every request, front-end and admin.

That is the other side of “always update immediately”. You had to apply 7.0.4. You should apply 7.1 — but not blind on production while cache and audit plugins are in the stack.

If the site is white

1. Do not roll core back as the first move. The fault is in the plugin. Downgrading 7.1 hides the symptom and leaves you on an old branch.
2. Get in through files, not wp-admin. In the panel or over SFTP, rename the broken plugin folder — typically wp-content/plugins/wp-rocket or wp-security-audit-log. WordPress stops loading it. The site comes back.
3. Log in, update the plugin, rename the folder back. Rocket at least 3.23.2.2, Activity Log 5.6.6. Then clear caches.
4. Read the PHP log, do not guess. The message names the file and the plugin. Rename that one folder, not the whole plugins directory.

No payloads, no “here is how you reproduce the crash”. If you run a site, you need the plugin version and a way back into the admin.

Checklist before you pull 7.1 next time

1. Snapshot plus database. On a Frankfurt VPS or root box you pick the time — the auto-updater does not.
2. Plugins first. Cache, security, SEO, page builders. “Tested up to 7.1” is the floor, not a blank cheque.
3. Staging, then production. Clone, run 7.1 there, click for five minutes. Then live.
4. Keep core auto-updates tight. Security minors (7.0.4) can go automatic. Majors like 7.1 belong in a window you start yourself.
5. Imagick/Ghostscript and Author roles are still the 7.0.4 story. 7.1 does not replace that patch.

What this means for VPS customers

Shared hosts often roll 7.1 centrally and catch plugin wreckage for you. On a self-managed VPS nobody does. File access in the panel is then the difference between five minutes and a ticket at midnight.

Order a V-Server →
Linux root server · WordPress 7.1 “Mary Lou” · WP Rocket: 7.1 fix