20 October 2026
On October 6, 2026, WordPress released version 7.1.3, a maintenance and security update that fixes seven vulnerabilities. The release includes three high-priority security fixes, and the software provider advises all WordPress users to update their sites immediately.
What's in the 7.1.3 Release
WordPress 7.1.3 is a targeted maintenance and security release that patches critical bugs and vulnerabilities. The update can be accessed through the WordPress dashboard, under Dashboard → Updates → Update Now, or by downloading version 7.1.3 from the official WordPress website. Server administrators are advised to check that their WordPress version is updated to 7.1.3, or at minimum, a security backport with equivalent fixes.
Multiple Critical Security Flaws Fixed
The update addresses seven security vulnerabilities, ranging from XSS and DoS risks to privilege escalations and unauthorized data disclosure. Of particular note:
- A stored XSS vulnerability in the Comments admin area, exposed by pending comments.
- A denial-of-service (DoS) issue in `WP_Http::make_absolute_url()` that could disrupt site availability.
- A second-order SQL injection flaw in the WordPress XML Export (WXR).
- Unauthorized privilege escalation from Author to sticky-post setting.
- Unauthenticated data disclosure of private and unpublished post comments.
More on this is available via extrabetting.net racing.
- XSS risk from Imgur embeds.
- Forgeable `{status}_{type}` hook parameters leading to action collision.
Why This Matters
With seven security vulnerabilities addressed, including three listed as high-priority, the WordPress Core Team is urging an immediate update. The intensity of the message speaks to the seriousness of these flaws, which are collectively exploitable across many common web publishing workflows. Waiting risks leaving critical components exposed.
What WordPress Users Should Do
Security releases should not be delayed. If you have not done so, immediately update your WordPress installation to version 7.1.3. As long as the automatic update function within your dashboard, you can update by going to Dashboard → Updates → Update Now. For those who prefer to manually download and update, WordPress 7.1.3 is available on the official WordPress website. Always verify the update is complete, either through the dashboard or by looking for a notification saying that "You have the latest version of WordPress installed."
Security Updates Receives Prominent Curtains
In a coordinated display of reporting and advocacy, WordPress made public communications October 6-7 across all of its news and documentation pages, stressing urgency. Meanwhile, third-party security coverage from Search Engine Journal among other outlets also pushed fast patching, adding to the chorus of prompting. The multilingual and global nature of WordPress usage means that the security advisory is being repeated in multiple language and localization pages, each tailored for their different local users, and provinces across the globe.
For full details on the vulnerabilities and fixes, consult the official WordPress 7.1.3 documentation and changelog. The documentation provides additional technical information as well as guidance for any necessary remediation following the update or if an update is not possible.
