WordPress 7.1.3 Security Release Ships 7 Security Fixes: Update Now

WordPress has shipped a new maintenance and security update, and this one deserves your attention. Announced on October 17, 2026, the WordPress security release version 7.1.3 bundles seven security fixes alongside four bug fixes — and the project is urging every site owner to update immediately. Led by release coordinator Jake Spurlock, the WordPress security release was produced through asynchronous coordination across the community, with the usual discipline these security rollouts are known for.

If you manage a WordPress site, you have seen these announcements before. What makes this WordPress security release worth a full read is the composition of its fix list: AI-lab researchers finding SQL injection in core, a flaw that exposed private comments to the public with no login, and backports reaching all the way to WordPress 4.7. Let us walk through what shipped, who it affects, and what to do.

What Happened: Inside This WordPress Security Release

A WordPress security release is a minor version bump — 7.1.3 in this case — that exists for one reason: to get vulnerability fixes onto sites as fast as possible. Unlike major releases, which add features and go through beta cycles, a security release is narrow, surgical, and meant to be installed without fear of breaking your theme or plugins. The 7.1.3 WordPress security release follows that template exactly: seven security fixes, four maintenance bug fixes, no new features.

Here is the full security fix list for this WordPress security release, with the researchers credited:

1. Stored cross-site scripting on the Comments administration page — reported by Thomas Chauchefoin of Trail of Bits. Stored XSS is a serious category: malicious script saved in the database executes in the browser of anyone who views the affected page — in this case, site administrators viewing the Comments screen. An admin-session XSS can be a stepping stone to full site takeover.

2. Denial-of-service in WP_Http::make_absolute_url — reported by Anthropic. A denial-of-service flaw lets an attacker make a site unresponsive or consume its resources. This one sits in WordPress’s HTTP utility layer, which handles outbound requests and URL normalization across core.

3. Second-order SQL injection in WordPress WXR export — reported by Anthropic. Second-order SQL injection is a subtler variant of the classic flaw: malicious input is stored safely the first time, then used unsafely later in a different context — here, during WXR (WordPress eXtended RSS) export, the format used to move content between sites. Anthropic finding core SQL injection is notable in itself: an AI research lab is now among the auditors stress-testing WordPress core.

4. Author-role users able to sticky posts — reported by Anthropic. Stickying a post pins it to the top of the blog listing, a capability normally reserved for editors and administrators. A privilege boundary flaw that lets lower-privileged users reach beyond their role is exactly the kind of issue that compounds: on its own it is a nuisance, chained with something else it can be worse.

5. Unauthenticated disclosure of comments on private and unpublished posts — reported by Ananda Dhakal of Patchstack. This is arguably the headline item in the WordPress security release. Comments attached to private or unpublished posts — content the site owner explicitly chose not to make public — could be disclosed to anyone, with no login required. For sites that use private posts for internal drafts, client reviews, or embargoed content, this is a genuine confidentiality breach.

6. Cross-site scripting in Imgur embeds — reported by Zhengyu Liu, Jingcheng Yang, and Gavin Zhong. Embed handling is a classic XSS surface: content pulled from third-party services gets rendered in your pages, and if the sanitization has gaps, attacker-controlled markup can ride along.

7. Forgeable parameters — reported by Alex Concha of the WordPress security team. Parameter forgery flaws let attackers craft requests that the application treats as legitimate, potentially reaching functionality or data that should have been out of reach.

Alongside the security fixes, the WordPress security release includes four bug fixes — the routine maintenance items that keep the 7.1 branch healthy. Security releases deliberately keep those minimal so the update is low-risk.

Backports to 4.7

One detail worth highlighting: as a courtesy, the security fixes in this WordPress security release are being backported to eligible branches through version 4.7. That is a long support tail, and it exists for a practical reason — a meaningful number of sites still run older branches, and security fixes should reach them even though only the most recent version of WordPress receives active feature support. If your site is on an older supported branch, watch for the corresponding backported security release and apply it.

Who Is Affected by This WordPress Security Release

The short answer: anyone running WordPress 7.1.x who has not yet updated, plus anyone on older branches awaiting their backported fix.

The longer answer depends on which flaw worries you most:

• Sites with private or draft content should treat the unauthenticated comment disclosure as the priority item. If your workflow involves private posts — client staging content, internal notes, pre-publication reviews — comments on those posts may have been visible to anyone who knew where to look.
• Sites with many users should note the Author-role sticky-post boundary issue and the Comments-admin XSS, both of which involve the multi-user trust model.
• Sites that import or export content (agencies migrating clients, publishers syndicating content) should note the WXR export SQL injection.
• High-traffic sites should note the denial-of-service fix in the HTTP layer, since availability is the asset most directly at stake there.

How to update

Site administrators can download the new version from the official project website or, more simply, run the upgrade from the WordPress Dashboard under Dashboard → Updates. Sites that support automatic background updates will begin the process automatically — minor releases like this WordPress security release are exactly what background updates are for. After updating, verify the version number shown in the dashboard reads 7.1.3.

Why This WordPress Security Release Matters

1. Confidentiality bugs are trust bugs

The unauthenticated disclosure of comments on private and unpublished posts is the kind of flaw that erodes trust, not just security. Site owners choose “private” because they mean it — client deliverables, internal discussions, embargoed announcements. A WordPress security release that fixes a confidentiality breach is fixing a broken promise, and the sooner it is installed, the smaller the exposure window.

2. AI labs are now core auditors

Anthropic credited on two core findings — a denial-of-service and a second-order SQL injection — is a sign of the times. Frontier AI labs have the compute and the motivation to audit widely deployed open-source software at scale, and WordPress core is an obvious target. Expect more AI-assisted vulnerability research landing in future WordPress security release notes. For site owners, this is good news: more eyes on core means more fixes. It also means the fix cadence will not slow down.

3. Security releases are the cheapest update you will ever install

A WordPress security release is deliberately boring: no features, minimal bug fixes, maximum compatibility. The risk of updating is tiny; the risk of not updating is the entire fix list above, now public. Attackers read release notes too — every item in this WordPress security release is now a known, documented weakness in every unpatched 7.1.x site. Patching within days, not weeks, is the entire game.

4. Backports only help if you install them

The backport policy through 4.7 is generous, but a backported fix sitting on wordpress.org does nothing for a site whose owner never clicks update. Older-branch sites are disproportionately the ones with the least active maintenance. If you know someone running an old WordPress — a client, a friend, a community site — this WordPress security release is a good reason to check in.

5. Release notes are now attacker reconnaissance

Every item in this WordPress security release ships with a researcher credit and a precise description of the flaw class. That transparency is good for the ecosystem — but it also means the release notes function as a targeting list. The stored XSS location (Comments admin), the vulnerable function (WP_Http::make_absolute_url), the WXR export path — all of it is now documented. Attackers automate against exactly this kind of structured information. The practical consequence is that the safe patching window after a WordPress security release keeps shrinking, and “I will update this weekend” is an increasingly expensive sentence.

What to Do Now: 5 Proven Steps for This WordPress Security Release

Step 1: Update to 7.1.3 today

Go to Dashboard → Updates and install the update now. This WordPress security release is a minor bump — it will not redesign your site or break your theme. If automatic background updates are enabled, confirm they actually ran: check that the dashboard footer shows version 7.1.3. Do not assume; verify.

Step 2: If you run private posts, review your comment exposure

The unauthenticated disclosure flaw means comments on private and unpublished posts could have been visible. Review whether any sensitive discussion happened in comments on non-public posts — client feedback, internal notes, pricing discussions — and treat anything posted there as potentially seen. Going forward, keep truly sensitive discussion off the site entirely.

Step 3: Audit user roles and capabilities

The Author-role sticky-post issue is a reminder to review who holds which role. Go to Users → All Users and confirm that everyone with Author, Editor, or Administrator access still needs it. Remove stale accounts — former contractors, old freelancers, test users. Fewer privileged accounts means fewer paths for the next privilege-boundary flaw.

Step 4: Confirm your older-branch sites got their backports

If you manage any sites on branches older than 7.1, check for the backported security release corresponding to this WordPress security release and install it. The backport policy covers branches through 4.7, but only the latest version gets active support — treat an old branch as a migration candidate, not a permanent home.

Step 5: Turn on automatic background updates if they are off

Minor releases like this WordPress security release are precisely what automatic background updates exist to install. If your site does not support them — some hosts disable them — ask your host to enable them, or adopt a managed maintenance routine that applies security releases within 24–48 hours. The gap between disclosure and patching is the attacker’s window; automation closes it.

FAQ: WordPress 7.1.3 Security Release

Q: What is in the WordPress 7.1.3 security release?
A: The WordPress security release 7.1.3 includes seven security fixes — stored XSS on the Comments admin page, a denial-of-service in WP_Http::make_absolute_url, second-order SQL injection in WXR export, Author-role sticky-post privilege issue, unauthenticated disclosure of comments on private/unpublished posts, XSS in Imgur embeds, and forgeable parameters — plus four bug fixes.

Q: Do I need to update if my site uses automatic updates?
A: Probably it already updated — but verify. Check that your dashboard shows version 7.1.3. Automatic background updates handle minor WordPress security release bumps, yet a failed or interrupted update can leave you exposed while you believe you are protected.

Q: Which WordPress versions get this WordPress security release?
A: Version 7.1.3 is the release itself, and the security fixes are backported to eligible branches through 4.7. Only the most recent WordPress version receives active support, so updating to the latest branch is always the strongest position.

Q: What is the most serious fix in this WordPress security release?
A: The unauthenticated disclosure of comments on private and unpublished posts stands out: it is a confidentiality breach requiring no login, affecting content site owners explicitly marked non-public. The stored XSS on the Comments admin page is also significant because it targets administrator sessions.

Conclusion

Seven security fixes, four bug fixes, backports to 4.7, and a clear instruction: update now. This WordPress security release is not dramatic, and that is the point — routine, boring, fast patching is what keeps a WordPress site out of the incident reports. The flaws it fixes are now public knowledge, which means every unpatched site is running a documented vulnerability list. The update takes minutes. The alternative — explaining to a client why their private content was public — takes considerably longer.

Staying on top of every WordPress security release is exactly what managed maintenance is for. Qamar Digital Ventures LLC‘s website care plans apply security updates promptly, monitor your site around the clock, and handle the audit steps most owners skip. Visit https://qamardigitalventuresllc.com/ and make the next WordPress security release somebody else’s 2 a.m. problem.

Sources

• MisrYoum, “WordPress 7.1.3 Maintenance and Security Release Now Available” (Oct 17, 2026) — https://misryoum.com/wordpress-7-1-3-released-with-critical-security-and-maintenance-fixes-2