WordPress 7.1.3 Security Release: What It Fixes and How to Update Safely

WordPress 7.1.3 is out, and you should install it today. The WordPress core team released it on October 6, 2026 as a maintenance and security release that patches seven vulnerabilities and fixes four bugs. The official announcement is direct: “Because this is a security release, it is recommended that you update your sites immediately.”

This comes only two weeks after WordPress 7.1.2 (September 22, 2026). If you skipped that one, this update covers both. Below you’ll find what each fix means in plain language, who is at risk, and how to update from the dashboard, with WP-CLI, or across many client sites at once.

WordPress 7.1.3 at a Glance

Detail	Info
Version	WordPress 7.1.3
Release date	October 6, 2026
Release type	Maintenance and security
Security fixes	7
Bug fixes	4
Release lead	Jake Spurlock
Backports	In progress for branches eligible for security fixes (back to 4.7)
Recommended action	Update immediately

The 7 Security Fixes in WordPress 7.1.3

Here is each vulnerability from the official release post, with a short note on what it means for a normal site owner.

1. Stored XSS on the Comments admin page

A stored cross-site scripting (XSS) bug could be triggered through pending comments on the Comments administration screen. In simple terms, an attacker could leave a comment containing malicious script that runs when a moderator opens the comments screen. Reported by Thomas Chauchefoin at Trail of Bits.

2. Denial of service in WP_Http::make_absolute_url()

A DoS issue in a core HTTP helper method. Reported by Anthropic.

3. Second-order SQL injection in WXR export

The WordPress export tool (Tools → Export, which creates a WXR/XML file) had a second-order SQL injection. “Second-order” means the malicious data is stored first and only executes later, here during an export. Reported by Anthropic.

4. Author role users could sticky posts

Users with the Author role could make posts “sticky,” which is normally an Editor-level action. Low risk on its own, but a clear permissions gap. Reported by Anthropic.

5. Unauthenticated disclosure of comments on private and unpublished posts

Anyone, without logging in, could read comments on private or unpublished posts. Patchstack, in its analysis of the release, calls this the most concerning issue because it needs no account at all. Reported by Ananda Dhakal from Patchstack.

6. XSS in Imgur embeds

Imgur embeds were vulnerable to cross-site scripting. Reported by Zhengyu Liu, Jingcheng Yang and Gavin Zhong.

7. Forgeable hook parameters causing action name collisions

Parameters passed to the {status}_{type} hook could be forged, leading to action name collisions. Whether this matters on your site depends on which plugins hook into it. Reported by Alex Concha of the WordPress security team.

How serious is this?

The official post does not publish CVSS scores. Patchstack rates most of these issues low to moderate and says, “Update as soon as you can, but this isn’t a drop-everything emergency.” That is fair, but there is a catch: once fixes are public, attackers can study the patch. Sites that stay on 7.1.2 or older for weeks are the easy targets. Update now and you don’t have to think about it again.

Who Should Update First

• Sites with open comments. Two of the seven fixes involve comments (the stored XSS and the comment disclosure). Blogs, news sites and tutorial sites with active comment sections are the most exposed.
• Multi-author sites. If you have Authors or Contributors (guest bloggers, a content team, a client’s staff), the role-related fixes apply to you.
• WooCommerce and membership stores. Stores carry customer data and payment flows. Many Indian stores are heading into the festive sale season right now, which is exactly when you don’t want an incident.
• Agencies and freelancers managing client sites. One unpatched client site can become your weekend problem.

How to Update to WordPress 7.1.3

Before any update, take a backup. It takes two minutes and saves hours.

Step 1: Back up your site

From your hosting panel (cPanel, hPanel, Plesk) use the backup tool, or with WP-CLI:

bash

# Export the database to a dated SQL file
wp db export backup-$(date +%F).sql

# Archive wp-content (themes, plugins, uploads)
tar -czf wp-content-$(date +%F).tar.gz wp-content

Step 2: Update from the WordPress dashboard

1. Log in to wp-admin.
2. Go to Dashboard → Updates.
3. Click Update Now.
4. Confirm the version at the bottom-right of the admin footer, or under Dashboard → Updates.

If your site supports automatic background updates, the update may already be done.

Step 3: Update with WP-CLI (faster)

If you have SSH access, this is the cleanest method:

bash

# Check the current version
wp core version

# Update to the latest release
wp core update

# Update the database if needed
wp core update-db

# Confirm core files match the official checksums
wp core verify-checksums

# Confirm you are on 7.1.3
wp core version

wp core verify-checksums is worth running after every security release. If it reports modified core files, investigate before you move on.

Step 4: Update many sites at once

For freelancers managing several client sites on one server, a simple loop works:

bash

for site in /var/www/*/public_html; do
  echo "Updating $site"
  wp core update --path="$site" && wp core update-db --path="$site"
  wp core version --path="$site"
done

Add --allow-root only if your setup requires it, and test on staging first for complex sites.

Step 5: Make sure minor updates install automatically

Security releases like 7.1.3 are minor releases. Check that wp-config.php does not block them. This line keeps minor (security) updates automatic:

php

// Allow automatic minor/security core updates
define( 'WP_AUTO_UPDATE_CORE', 'minor' );

If you see define( 'AUTOMATIC_UPDATER_DISABLED', true ); in wp-config.php, auto-updates are turned off entirely. Only keep that if you have another reliable patching process.

What If You Can’t Update Today?

Sometimes a client site is locked to an old version because of a custom theme or plugin. Until you can update:

• Review pending comments carefully and consider bulk-deleting obvious spam from the database instead of opening each one.
• Avoid running Tools → Export on the live site.
• Check user roles and remove Author or Contributor accounts that are no longer needed.
• Turn on a web application firewall (WAF) at the host, Cloudflare or plugin level.

The official post says security fixes are being backported, where necessary, to all branches eligible for security fixes (currently back to 4.7), and those backports “will ship as they become ready.” Keep in mind the team’s reminder that only the most recent version of WordPress is actively supported.

India-Specific Notes

Many small business sites in India run on budget shared hosting where SSH is not available. In that case, use the dashboard update or your host’s one-click WordPress manager. Some hosts delay core updates by a day or two, so log in and check rather than assuming it happened.

If your site takes UPI or card payments through a WooCommerce gateway plugin, update core first, then check that your payment plugin still works with a small test order before your next sale campaign.

Key Takeaways

• WordPress 7.1.3 was released on October 6, 2026 with 7 security fixes and 4 bug fixes.
• Two fixes involve comments, including one that let anyone read comments on private or unpublished posts.
• The fixes cover XSS, SQL injection, a DoS bug and role/permission gaps.
• Update from Dashboard → Updates or with wp core update, then run wp core verify-checksums.
• Keep minor auto-updates on so future security releases install without you.

FAQs

Need Help Updating or Securing Your Site?

If you manage several WordPress or WooCommerce sites and want them patched, backed up and monitored without the stress, I can help. I’m Pradeep, a Delhi-based developer with 13+ years of experience building and maintaining WordPress, WooCommerce, Shopify and Laravel sites for businesses across India. Contact me for a security update, a site health check or a full rebuild.