WordPress Ships Security Releases Across All Supported Branches
WordPress shipped a fresh round of WordPress security releases on October 6, 2026, patching every still-supported branch in one coordinated push. The headline package, WordPress 7.1.3, carries seven security fixes and four bug fixes, and the project urges all site owners to update immediately. Matching backport builds landed for older branches all the way down to 4.7, each carrying the same security fix, so even sites running legacy WordPress are covered by this round of WordPress security releases.
What Happened in This WordPress Security Releases Round
WordPress 7.1.3 is a maintenance and security release led by release leader Jake Spurlock. It is the third WordPress security update in just nineteen days: version 7.1.1 arrived on September 17 with eleven security fixes, followed by 7.1.2 on September 22. That pace is new for WordPress, and it has a clear cause. The project’s bug bounty program historically received twenty to thirty vulnerability reports per month; in July 2026 that number jumped to roughly 450. Public program statistics now show about 2,000 reports over the past ninety days and more than $90,000 in bounty payouts in that window, compared with just over $200,000 paid since 2017. WordPress attributes much of the surge to AI models that can analyze source code and find potential vulnerabilities at scale, and in August it announced a Core Security Initiative to accelerate the security release process and work through the backlog.
The seven fixes in this release, explained in plain English:
- Stored XSS on the Comments admin page. A malicious link planted in a pending comment could execute script code when a moderator clicked it. Reported by Trail of Bits in collaboration with OpenAI, this one targets site administrators directly.
- XSS in Imgur embeds. Imgur had been incorrectly whitelisted as a trusted oEmbed provider, letting it bypass sandbox filtering of user-supplied content. Reported by Zhengyu Liu, Jingcheng Yang, and Gavin Zhong. Note that cached oEmbed content survives the update and may need to be cleared manually.
- Second-order SQL injection in WXR export. The Tools-to-Export feature could be abused for database injection, requiring an administrator to run an export.
- Authors could sticky posts they should not. A permission flaw let lower-privileged authors pin posts to the front page.
- Unauthenticated disclosure of comments on private and unpublished posts. Comment feeds could leak comments that were never meant to be public, with no login required.
- Forgeable status-hook parameters. Manipulated parameters passed to status hooks could cause action-name collisions, relevant when plugins pass raw status or type values.
- Denial of service in WP_Http::make_absolute_url(). A flaw in the HTTP helper could be used to knock a site offline.
Three of the seven issues were reported by Anthropic, with additional credit to Patchstack, the WordPress security team, and independent researchers. The release also fixes a critical image-upload fatal affecting hosts missing PHP’s DOM extension — a severity-of-the-bug issue rather than a CVE. Notably, WordPress published no CVE numbers in the 7.1.3 release notes, and no in-the-wild exploitation or public proof-of-concept has been confirmed for these specific issues. That said, Patchstack observed attackers attempting to exploit the disclosed flaws within hours of the fix becoming public — the window between disclosure and attack traffic is now measured in hours, not weeks.
Who Is Affected by the WordPress Security Releases
If your site runs WordPress 7.1.0 through 7.1.2, you need 7.1.3. If your site runs any branch from 4.7 upward, the WordPress security releases include a matching backport for you: branches such as 6.6, 6.1, 5.9, 5.5, 5.0, and 4.7 each received a single-fix security build (for example 6.1.15, 5.9.19, 5.5.23, 5.0.30, and 4.7.38). At publication time, backports were fully available through 6.6 with the 4.7-through-6.5 packages following. Running an unsupported branch means missing future WordPress security releases entirely, so legacy sites should treat this update as the start of a migration plan, not the end of one.
Two of the seven issues can be reached without any login, while several others require Contributor or Author privileges — or an administrator to trigger an export. That mix means both open-registration sites and tightly locked-down sites have exposure. One important caveat from the security community: only the latest WordPress version is fully supported. Backports are a bridge, not a strategy — sites on 4.6 or older receive no security updates at all and need a rebuild or migration rather than more hardening.
Why These WordPress Security Releases Matter
WordPress powers an enormous share of the web, so a core flaw reaches millions of sites at once — and the WordPress security releases backport this far down the version tree precisely because legacy branches are where botnets recruit. Stored cross-site scripting in the admin area is a classic path to full site takeover: a compromised admin account means attackers can install plugins, create users, and turn the site into a spam or malware node. Unauthenticated disclosure of comments on private posts is quieter but can leak sensitive business or client information. And with AI-assisted tools now letting attackers turn a published fix into a working exploit in hours, a security update that reaches your site a month late offers far less protection than it did a few years ago. Updating promptly is the single highest-leverage action a site owner can take, and the accelerating WordPress security releases cadence is the new normal to plan patch windows around.
What to Do Now After the WordPress Security Releases
- Update immediately. Go to Dashboard, then Updates, and install 7.1.3 — or the backport build your older branch offers. Then verify the installed version actually changed.
- Clear caches and cached embeds. Purge your caching layer and clear cached oEmbed content so the Imgur fix takes full effect.
- Review user accounts. Remove stale accounts, demote unnecessary admins, and look for any unexpected administrator accounts that may signal a prior compromise.
- Scan upload directories. Check wp-content/uploads and similar folders for unexpected PHP files, a common footprint of automated exploitation.
- Turn on automatic background updates for minor and security releases so future WordPress security releases install themselves.
- Back up before and after. Keep a tested backup from before the update, and schedule regular backups going forward.
- Plan your upgrade path. If you are on 4.7 through 6.x, schedule a move to a current major release — the jump is a project (PHP version, theme, plugins), not a one-click patch, because the next round of WordPress security releases may not reach your branch at all. professional web design and development help can keep the migration safe.
WordPress Security Releases: Frequently Asked Questions
Do I need to update if I run an old WordPress like 5.x?
Yes. This round of WordPress security releases ships a matching single-fix backport for every branch down to 4.7. Install the backport for your branch now, then plan a full upgrade — only the latest version is fully supported.
Is this an emergency or a routine update?
Treat it as urgent but orderly. Two issues can be reached without authentication, and Patchstack saw exploitation attempts within hours of disclosure. Update this week, not next month.
Will updating break my site?
Security and maintenance releases are designed to be safe, and 7.1.3 even fixes an image-upload fatal some hosts hit after 7.0. Still, back up first and check key pages after updating.
Are there CVE numbers for these flaws?
WordPress did not assign CVE numbers in the 7.1.3 release notes, and no in-the-wild exploitation of these specific issues has been confirmed. The absence of a CVE does not mean the absence of risk.
WordPress Security Releases: Conclusion and Next Steps
This round of WordPress security releases is a reminder that the threat landscape around WordPress is accelerating: AI-assisted vulnerability discovery is flooding the bounty program, fixes are shipping every few weeks, and attackers are probing within hours of disclosure. The good news is that WordPress backported this fix to every supported branch down to 4.7, so no site has an excuse to stay exposed. Update to 7.1.3 or your branch’s backport today, clear your caches, review your user accounts, and start planning the move off legacy branches if you have not already.
Staying current with this pace of security releases is exactly what Qamar Digital Ventures LLC‘s website care plans are built for — timely updates, security monitoring, and tested backups handled for you. Visit https://qamardigitalventuresllc.com/ to learn more, or contact us to discuss a care plan for your site.
