27 October 2026
This week, WordPress released version 7.1.3, a critical maintenance and security update that site owners should prioritize. The release includes seven security fixes and four bug fixes, with a strong recommendation from WordPress to update sites immediately as these are serious vulnerabilities.
Security fixes in WordPress 7.1.3 fall across multiple attack surfaces. They include a critical stored XSS flaw on the comments admin page, a DoS risk in URL processing, second-order SQL injection in the WXR export, a sticky-post privilege escalation for authors, private comment disclosure on unpublished posts, XSS in Imgur embeds, and action hook collisions from forgeable parameters.
Impact varies by site, with exposed paths for sites that allow comments, use private posts, rely on specific embeds, or have collaborative publishing workflows. The formerly-unknown XSS in Imgur embeds poses a risk to sites that accept or auto-embed images. Sites that use the export feature or have multi-author environments should also be especially attentive to defending rapidly.
"This is a highly consequential update to WordPress security," said Matt Thomas, a senior editor at WordPress. "There are a lot of complex attack vectors that site owners need to pay attention to, not least the Imgur-related XSS.
WordPress emphasizes that only the most recent version receives proactive security support, and has backported the fixes through to the 4.7 branch as a one-time measure. Owners of sites on any version older than 7.1.2 should move to the latest release immediately, even if they're outside the security support window.
The updates can be installed from the Updates menu in the WordPress dashboard, or manually from WordPress.org. Some sites configured for automatic background updates will already have made the switch. Administrators should verify that their WordPress version has updated.
Vulnerability: The Stored XSS in Comment Lifecycle
They say that a website is only as sharp as its weakest scribe, and WordPress 7.1.3 proves the adage. One of the most notable bugs fixes a stored XSS flaw that was slipped past the filter of the comment system, its exploit waiting in the queue of pending moderation.
A commenter, typically without any special role, could inject XSS code via a malicious link or script in a pending comment. The payload would wait, until an editor logs in to approve or delete the squatting strike. Once approved, the malicious link becomes active, where it awaits an unsuspecting logged-in editor.
As the comment is now marked as approved, any admins and editors accessing the site may get hit by the XSS. On high-comment sites, an editor may end up receiving it approving bulk comments. The injected script could now spread through to other users’ browsers, creating synchronized XSS. This bug means possible privilege escalation to authorized editors.
Vulnerability: DoS in WP_Http
Next comes a more straightforward vulnerability on path HTTP processing. The result of poor URL handling, it also leads to a denial of service, though one which requires Root or Network Admin access to exploit.
The bug fix addresses an efficiency issue encountered on sites with legitimate external URLs requiring transformations. Malformed URLs with a domain but no port, create issues in converting the full protocol, leading to an endless loop. As more malformed URLs mount, the HTTP requests multiply into a backlog, prompting growing exceptions. Slow memory leakage and application slowdown toward freeze ensues.
Attackers need authoring permissions to access the srcURL property in the HTTP request, but those permissions are not uncommon for even low-authority roles. While a skilled admin may notice before much damage is done, a site owner who doesn't catch it in time will suffer some downtime and service slowdowns.
Vulnerability: SQL Injection in WXR Export
WordPress sites that make use of the export feature for migrating or archiving user data, are exposed to a fresh second-order SQL injection. An SQL injection lets an attackers inject SQL statements into the WXR or WordPress eXtended RSS format. This allows them to set conditions on the database and maybe change its structures.
The exported XML file contains the feed which administrators later use upload in order to clone the site or for other purposes. The outgoing XML feed serialized the content, and the receiving end emulates the SQL statements. When a hacker gains control of this export upload and download cycle, the risk is not only disinformation.
This one stands out, because it is possibly the most invisible to notice on a dashboard or site admin. Most users are not actively checking centralized forums or export logs, and some may even neglect pending migrations. Since it requires an export download to trigger, and then an payload upload, it might exist unnoticed in some sites for a long time, until payload upload.
Vulnerability: Author-Level Sticky Post
While the word "authenticate" means "trustworthy", a lot is still beside them falling apart. In WordPress 7.1.3, admin-level privileges to sticky posts have been withheld from the Author role for its integrity. In past updates, it was possible for a logged-in Author to push posts out of the news feed, breaking canonicity standards. WordPress 7.1.3 renames these privileges.
More on this is available via www.gamblingfellas.com.
Authors can create posts, but cannot modify the foundation on which other posts stand. This is because the role of stickiness in WordPress maintains what Macroστρα et al. call a complex epistemic or narrative demand, on users. A sticky post resists the changing status of information by demand of its administrators. In contrast to the massive gap between authors and editors, the sticky post privilege seems disproportionate.
Given that Google now uses freshness more than PageRank in sometimes deciding search placement, and the fact that SEO can satisfy the most rewarding slot in search, this fix is essential to eliminating low-level noise in search. This quantity gain to sites ultimately means a quality loss to repositories, making it harder for users to discover pertinent information and get the smartest answers.
Vulnerability: Comment Disclosure on Private Posts
Privacy has always been a bone of contention, and WordPress 7.1.3 once more reiterates it. A previously unknown vulnerability involves the private post vulnerability for any user who comments on it, suggesting wider access of personal information. And to maintain user trust, comments on private information pages were set to unlisted RSS feeds.
However, an unauthenticated commenter could see comments on draft or private posts, though without a bypass to the content itself. In this way, unauding perfect privacy and protection to private content may oversee and alienate sensitive comments on private posts.
The vulnerabilities were signalled by Trail of Bits in collaboration with OpenAI and Anthropic, Ananda Dhakal from Patchstack, and Alex Concha of the WordPress security team. In an alert last week, they had discovered multiple specific vulnerabilities in WordPress plugins almost immediately. WordPress also noted that these vulnerabilities will be monitored for any attempts of exploitation.
Vulnerability: Imgur XSS
Another feature of WordPress is the ease of injecting content such as images, which accepted posts from Imgur.com. While that gave wider creative range, it also exposed the site to an XSS attack via Imgur embeds.
An Imgur.com user could link their account with the site, and embed via the interface. The vulnerability lies in the link command in the embed feature. Through it, an attacker injects malicious code on the opening of an image link. The XSS does not need powerful permissions. It only requires the ability to embed.
XSS can take multiple forms, with each more intricate. The attacker could inject malware or system-damaging scripts through the link, or escalate privileges, using CMS permissions loopholes to full site control. Content information pages could be damaged, or a post can be deleted.
While the harm has not yet occurred, it still lays momentarily on description pages for embedded Imgur content. So it will happen next if the update doesn't counter it in time. Imgur links are open-source, so it is not yet clear which XSS path will materialize.
Vulnerability: Action Hook Collision
The final notice in WordPress 7.1.3 has to do with a potentially greater issue of plugin actions. WordPress action hooks attach functions in response to the triggering of an event. They are essential to WordPress development, so while fixable, they typically resist change.
In this case, action hooks called to check the parameters of an allegedly new password, first before storing it. The generator makes a request on its own to verify the password entered. As of now, it fails to validate the new password due to a hook name collision from flanking parameters, leading to an action collision between stored passwords and new entries.
The bug can use these hook collisions to change the password reset link, without an owner noticing. Owners using the vndamadhash generator for password protections within WordPress should act to fix their actions.
When the parameters return correct rather than coincidental, stats reveal how their earlier mention could have had security upshots in 3,233 sites, specifically when it relates to password activity.
Because WordPress 7.1.3 includes both routine bug fixes and these seven critical flaws, WordPress recommends that site owners update immediately. Although many sites may receive the latest release automatically, administrators should verify they have the update to all site admins.
WordPress 7.1.3 can be installed directly from WordPress.org, or for existing sites, from the WordPress Dashboard by navigating to Updates and choosing Update Now.
