19 October 2026
WordPress has released version 7.1.3, a critical security and maintenance update that patches seven vulnerabilities and resolves four bugs. The content management system giant is urging users to update their sites immediately due to the severity of the security flaws in this release.
Vulnerabilities Addressed in 7.1.3
The patch addresses multiple security concerns across comments, embeds, user roles, and data exports:
The release fixes a stored XSS vulnerability on the Comments administration page. This could be exploited by users posting malicious pending comments.
A denial-of-service issue existed in the WP_Http::make_absolute_url() method, which could allow attackers to crash certain WordPress installations.
A potential SQL injection risk was identified in the WordPress WXR export functionality.
Author role users were able to make posts sticky without proper permissions. This has been corrected.
A flaw could lead to unauthorized disclosure of comments attached to private or unpublished posts.
The Imgur embed functionality contained a reflected cross-site scripting (XSS) weakness.
More on this is available via how to deposit money at a legal US online casino.
Attackers could inject malicious action names into WordPress core or plugin/theme code due to vulnerable parameters passed to the {status}_{type} hook.
Given the broad scope of functionality affected – including comments, embeds, roles, and data exports – plugin and theme developers should review their code for potential impacts from the 7.1.3 update. Any code interacting with these patched components may require adjustments.
Hosting providers need to evaluate the impact on their managed WordPress services, particularly regarding the DoS fix and back-end issues reported on certain hosts.
Up Next for Sites and Hosts
WordPress.org strongly recommends all WordPress 7.1 users upgrade to 7.1.3 immediately due to the serious security risks including potential remote code execution and data theft.
For managed WordPress hosting, Pantheon has confirmed the latest WordPress release is available on its platform. They advise users to upgrade as soon as possible and note that their platform-level defenses protect against external exploitation of the stored XSS in comments, though this protection isn't included in their entry-level Personal plan.
The security enhancements are being backported to earlier WordPress versions, though this only applies to eligible branches. Only the current WordPress major release receives ongoing updates.
An unrelated bug remains unfixed in 7.1.3, which may cause sites to break on some hosts lacking the PHP DOM extension.
