On October 6, 2026, the WordPress core team released WordPress 7.1.3, a security release. The core team recommends updating immediately. Fixes are also available in older affected branches, but only the latest version of WordPress is actively supported.
What’s fixed?
The release addresses seven reported issues. Here is each one in plain language:
| Issue | Reported by | What it means for your site |
|---|---|---|
| Stored XSS on the Comments admin page, via pending comments | Thomas Chauchefoin, Trail of Bits | Malicious script in a pending comment could execute when an admin reviews comments. |
Denial of service in WP_Http::make_absolute_url() | Anthropic | A crafted input could degrade site availability. |
| Second-order SQL injection in WXR export | Anthropic | The WordPress export feature could be abused to run unintended database queries. |
| Author role users could sticky posts | Anthropic | A permissions weakness gave Authors an ability they shouldn’t have. |
| Unauthenticated disclosure of comments on private and unpublished posts | Ananda Dhakal, Patchstack | Comments on non-public content could be visible to anyone. |
| XSS in Imgur embeds | Zhengyu Liu, Jingcheng Yang, Gavin Zhong | Embedding Imgur content could be used to inject scripts. |
Forgeable parameters in the {status}_{type} hook | Alex Concha, WordPress security team | Crafted values could cause action name collisions. |
Several of these issues involve roles, private content, and the admin area. This is exactly where a vulnerability can turn into a data exposure or a compliance concern. Even without evidence of exploitation, unpatched core software is a common finding in security audits and vendor assessments. Keep updating timely.
How to update safely?
- Back up first. Take a full backup of files and database.
- Test on staging. Apply the update to a staging copy and check key templates, forms, and custom plugins. The release touches core files in the REST API, Customizer, oEmbed, query, and post handling, so custom code that hooks into those areas deserves a quick check.
- Update production. Go to Dashboard > Updates, or download the release from wordpress.org/download/releases.
- Verify. Confirm the version number, review error logs, and test comments, embeds, and user roles.
- Review user roles. Confirm that Author and Contributor accounts match what your team actually needs.
Files revised in 7.1.3
/wp-admin/js/common.js
/wp-admin/includes/export.php
/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
/wp-includes/class-wp-customize-manager.php
/wp-includes/class-wp-customize-setting.php
/wp-includes/class-wp-http.php
/wp-includes/class-wp-oembed.php
/wp-includes/class-wp-query.php
/wp-includes/post.phpNeed help with updates?
At WPDevelopers, we build and maintain WordPress sites, themes, and plugins for B2B teams across Europe and worldwide. If you’d like a managed update workflow with testing, backups, and post-update verification, get in touch.
Source: the official WordPress 7.1.3 release notes at wordpress.org.