WordPress Security Release 7.1.3 Lands — 7 Fixes, Third Release in Three Weeks

The WordPress security release 7.1.3 arrived on October 6, 2026, and it is one every site owner needs to take seriously. This WordPress security release is a maintenance and security update that fixes seven security vulnerabilities and four bugs in WordPress core — including a flaw that let anyone read comments on private or unpublished posts without logging in. What makes this WordPress security release notable is the pace: it is the third core security release in less than three weeks, and the sixth since mid-July. The days of updating “when convenient” are over.

What Happened in This WordPress Security Release

The WordPress security release closes seven distinct holes. Here is what each one means in plain English, and who could have triggered it:

1. Stored XSS on the Comments admin page, via pending comments. A malicious link hidden inside a comment awaiting moderation could run scripts inside the WordPress admin area — but only if a moderator (Editor or higher) clicked it. Reported by Trail of Bits in collaboration with OpenAI.
2. Unauthenticated disclosure of comments on private and unpublished posts. Comments on drafts and private posts could be viewed without logging in — no account needed. Reported by Ananda Dhakal of Patchstack.
3. Second-order SQL injection in the WXR export. A poisoned value already sitting in the database (such as a crafted _thumbnail_id) could execute database commands when an administrator ran Tools → Export. Reported by Anthropic.
4. Author-role users could make posts sticky. Author accounts could pin posts to the top of the blog — a privilege they should not have. Reported by Anthropic.
5. Denial of service in WP_Http::make_absolute_url(). A crafted request from a Contributor-level account could tie up server resources. Reported by Anthropic.
6. XSS through Imgur embeds. Embedded Imgur content could bypass WordPress’s content filtering — Imgur was on WordPress’s trusted oEmbed provider list and skipped the sandboxed-iframe filter, so text from an uploader’s own image or album could land on a page unfiltered. Needs a Contributor-level account plus someone viewing the post. Reported by university researchers Zhengyu Liu, Jingcheng Yang, and Gavin Zhong.
7. Forgeable {status}_{type} hook parameters. A plugin passing raw post statuses or post types into wp_insert_post() could cause action-name collisions with unrelated hooks. Reported by Alex Concha of the WordPress security team.

WordPress publishes no CVSS scores with core security releases, so the right way to read this list is as seven doors that needed closing — not an invented severity ranking. That said, Patchstack’s analysis of this WordPress security release is useful context: two of the issues can start with an unauthenticated visitor, three need a Contributor or Author account, one needs an administrator running an export, and one is plugin-dependent hardening. Their verdict: “update as soon as you can, but this isn’t a drop-everything emergency.”

This WordPress security release also ships four maintenance bug fixes. One that many sites will notice: image uploads failing with a fatal error on hosts missing PHP’s DOM extension. If your media uploads have been broken since WordPress 7.0, testing an upload after updating is worth the minute.

Who Should Install This WordPress Security Release

Every WordPress site running an affected branch should install this WordPress security release. The security fixes have been backported to every branch still eligible for them, going back to WordPress 4.7 — so sites on older branches are not left behind. Here is the practical path:

• Running 7.1.0 – 7.1.2: update to 7.1.3 directly. If you have automatic minor updates enabled, your site may already be patched — verify in Dashboard → Updates.
• Running 7.0.x: install the latest 7.0 security package that includes these backports, then plan a move to 7.1.
• Running 6.x, 5.x, or 4.7+: install the backport build WordPress lists for your branch, then schedule a supported major upgrade.
• Running 4.6 or older: no security updates are issued for these branches anymore. Rebuild or migrate — do not try to “harden” a dead branch.

Sites with comments enabled are especially exposed to two of the fixes: the unauthenticated comment disclosure on private posts and the stored XSS on the Comments admin screen. If your site accepts public comments or has a large moderation queue, treat this WordPress security release as high priority. Sites with multiple Author or Contributor accounts should also pay attention, since several fixes involve those roles.

Why This WordPress Security Release Matters

The most important story in this WordPress security release is not any single fix — it is the cadence. WordPress shipped security releases on September 17 (7.1.1), September 22 (7.1.2), and October 6 (7.1.3) — three releases in under three weeks, and six since mid-July. In total, WordPress has closed 34 security holes in its core code in under 12 weeks.

That pace reflects a real shift in how vulnerabilities are found. AI-assisted security research has exploded report volume: WordPress’s bug bounty program went from reports “in the dozens” per month for nine years to 450 in July 2026. Anthropic alone is credited with three of the seven fixes in this WordPress security release (plus two more in 7.1.1), and OpenAI’s collaboration with Trail of Bits produced the comments XSS fix. The tools that find flaws faster work for defenders first — every one of these fixes was responsibly disclosed and patched before release — but the same automation is available to attackers, and patches are public the moment they ship. Patchstack has measured the weighted-median time from public disclosure to mass exploitation at roughly five hours.

The practical consequence: patch windows are now measured in hours, not weeks. A site that updates “sometime this month” can sit exposed for days after a disclosure. Automatic minor updates, once a nice-to-have, are now a core part of site security.

What to Do Now After This WordPress Security Release

Update this week, verify it, then clean house. Here is a safe routine:

1. Back up your site first. Take a full backup (files + database) before updating, so you can roll back if anything conflicts.
2. Update WordPress core to 7.1.3. Go to Dashboard → Updates and apply the update, or let automatic minor updates handle it — then confirm the version in the admin footer.
3. Test what makes money. After updating, test your checkout, contact forms, and any page that collects leads. If a plugin behaves differently, check the 7.1.3 milestone tickets on WordPress Trac for the four bug fixes.
4. Verify automatic updates are actually enabled. Many sites assume background updates are on when they are not (a disabled-by-host setting or a filter can silently turn them off). Check Dashboard → Updates and your Site Health screen.
5. Review user accounts and caches. Remove stale accounts with elevated roles, and clear any caching layers so the new code is actually what visitors get.
6. Test media uploads if they were broken. If uploads have failed since 7.0, try one now — the DOM-extension fatal is fixed in this WordPress security release.

WordPress Security Release: Frequently Asked Questions

Is 7.1.3 a WordPress security release?
Yes. The 7.1.3 WordPress security release shipped October 6, 2026, with seven security fixes and four bug fixes. WordPress recommends updating immediately because it is a security release.

What is the most serious flaw fixed in this WordPress security release?
The unauthenticated disclosure of comments on private and unpublished posts is the most broadly reachable — it needed no account at all. The stored XSS on the Comments admin page is also significant because admin screens are high-value targets.

Do I need this WordPress security release if my site is on 7.0 or older?
Yes. The security fixes were backported to every eligible branch back to WordPress 4.7. Install the backport build for your branch from Dashboard → Updates, then plan an upgrade to a supported major version.

Is this WordPress security release a drop-everything emergency?
Not quite — Patchstack’s assessment is “update as soon as you can.” It is less urgent than the 7.1.2 release, but the accelerating release cadence means unpatched sites are exposed within days of each disclosure.

What if my media uploads broke after WordPress 7.0?
This WordPress security release fixes a critical image-upload fatal on hosts missing PHP’s DOM extension. Update, then test an upload to confirm it works.

Conclusion

This WordPress security release is the third core security update in under three weeks and the sixth since mid-July — a pace that tells you everything about where WordPress security now stands. Seven more holes are closed, from an unauthenticated leak of private-post comments to SQL injection in the export tool and XSS in the comments admin. The fixes themselves are straightforward; the message behind this WordPress security release is the real story. With AI-assisted research flooding bug bounty programs — 450 reports in July alone — and exploitation following disclosures within hours, the era of casual, when-convenient updating is finished. Install this WordPress security release this week, verify your automatic updates are actually running, and treat every core security release as the time-sensitive event it now is.

Keeping a WordPress site on this cycle is exactly what a website care plan does for you. Qamar Digital Ventures helps businesses stay secure and grow online. Our website care plans keep your site patched, backed up, and monitored around the clock — so a WordPress security release like 7.1.3 gets applied before it becomes your problem. Visit https://qamardigitalventuresllc.com/ to learn more, or contact us to discuss your project.

Sources

• LetsKnowTech — WordPress 7.1.3: Every Change Explained and Tested: https://letsknowtech.com/wordpress-7-1-3/
• MagicWP — WordPress 7.1.3 Security Release: 7 Fixes Explained: https://magicwp.io/blog/wordpress-7-1-3-security-release
• Intuico Digital — WordPress 7.1.3 Security Update: What Small Business Sites Should Do: https://www.intuicodigital.com/blog/wordpress-7-1-3-security-update-small-business
• Fast2Host — WordPress Security Checklist for October 2026: https://www.fast2host.com/blog/wordpress-security-checklist-2026/