WordPress released version 7.1.3 on October 6, 2026, with seven security fixes and four maintenance fixes. WordPress recommends updating immediately. The release addresses stored cross-site scripting, a second-order SQL injection, private-comment disclosure and several permission or hardening issues.
What Happened
WordPress 7.1.3 patches seven security issues in core. They include stored cross-site scripting on the Comments administration screen through a pending comment; denial of service in WP_Http::make_absolute_url(); a second-order SQL injection in WordPress’s WXR export process; an Author-role permission weakness involving sticky posts; unauthenticated disclosure of comments on private or unpublished posts; cross-site scripting involving Imgur embeds; and a hook-name collision weakness that can affect plugin behavior.
The release also contains four bug fixes. WordPress says sites that support automatic background updates should begin receiving the update automatically. Security fixes are being backported where necessary to branches eligible for security updates, currently through WordPress 4.7.
Why It Matters
The seven issues do not all have the same prerequisites. Patchstack’s code review says two begin with an unauthenticated visitor, while others require a Contributor or Author account, an administrator performing an export, or particular plugin behavior. That distinction matters: customers should update promptly without assuming every issue creates the same exposure on every site.
For managed WordPress hosting, the practical question is whether core security updates are applied automatically and how the host verifies that the update succeeded across customer sites.
What the Company Says
The WordPress project classifies 7.1.3 as a maintenance and security release and recommends that site owners update immediately. WordPress credits researchers from Trail of Bits, Anthropic, Patchstack, independent researchers and the WordPress security team for responsibly reporting the issues.
HostingReviewLab Context
Version 7.1.3 follows the September 22 release of WordPress 7.1.2. The new release covers a broader collection of issues, but Patchstack characterizes it as an update-soon release rather than evidence that every WordPress site faces an immediate compromise.
Our managed WordPress hosting guide explains why automatic updates, staging, backups and recovery support should be evaluated together. Our hosting security responsibilities guide separates what a host handles from what remains the site owner’s job.
What We Haven’t Independently Verified
HostingReviewLab has not reproduced any of the vulnerabilities, audited the patches, or tested how quickly individual hosting providers deployed 7.1.3. The sources reviewed did not identify confirmed active exploitation of these specific 7.1.3 issues as of October 12, 2026; that is not proof that exploitation has never occurred.
What Customers Should Know
- Check the WordPress Dashboard or hosting control panel and confirm that the installed core version is 7.1.3 or a branch-specific backport containing the fixes.
- Take or confirm a current backup before a manual update, especially on sites with custom themes, plugins or ecommerce functionality.
- After updating, test logins, comments, forms, checkout and other business-critical workflows.
- If a managed host applies core updates automatically, verify the completed version rather than assuming the rollout has finished.
Event and publication date: October 6, 2026. Source checked: October 12, 2026. Updated: October 12, 2026. Verification status: Corroborated.