WordPress 7.1.3 Security Update: 7 Fixes Explained (2026)

WordPress 7.1.3 was released on October 6, 2026, and it is a security release. Seven security fixes and four bug fixes, and the official line is the one you should take at face value: “update your sites immediately.” This is the third security release on the 7.1 branch in under three weeks — 7.1.1 on September 17, 7.1.2 on September 22, and now 7.1.3 — which tells you the security team is in active triage mode. The good news: this is a minor release with no new features, so updating is about as safe as WordPress updates get. Here is what each fix actually means for a normal site owner, and how to update without turning a routine patch into an outage.

Table of Contents

WordPress 7.1.3: the seven security fixes, explained

The announcement lists seven issues, reported by a mix of familiar names — Trail of Bits, Patchstack, three independent researchers, the WordPress security team — and, notably, Anthropic, which reported three of the seven. No CVEs have been assigned in the release notes, and there is no confirmed exploitation in the wild or public proof-of-concept for any of these. Patchstack’s review of the actual code changes is the best public summary of who can trigger each one, and it is worth knowing because it tells you how scared to be.

1. Stored XSS on the Comments admin page (via pending comments)

A cross-site scripting flaw on the Comments administration screen, exploitable through pending comments. The attacker needs a moderator (Editor role or higher) to click a link inside a pending comment. Reported by Thomas Chauchefoin of Trail of Bits in collaboration with OpenAI. For a normal site owner, this means: keep comment moderation turned on, don’t click links inside comments you’re moderating, and update. If you have open comments with multiple moderators, this is the fix in 7.1.3 that most directly protects your admin area.

2. Denial of service in `WP_Http::make_absolute_url()`

A DoS issue in the method WordPress uses to resolve relative URLs into absolute ones — part of the HTTP API that core, themes, and plugins call constantly. Reported by Anthropic; requires a Contributor-level account to trigger. Most small sites won’t have untrusted contributors, so the practical risk is limited, but it’s the kind of bug that becomes nasty on multisite or membership sites where you give strangers Contributor accounts.

3. Second-order SQL injection in WXR export

A second-order SQL injection in the WordPress eXtended RSS (WXR) export — the file format WordPress uses for site exports. Reported by Anthropic; it needs an administrator to run an export and a bad _thumbnail_id value already sitting in the database. This is an unusual attack path, and the combination of preconditions makes it hard to weaponise against a typical site. Still, the fix is real, and it closes a gap in a feature administrators touch regularly during migrations.

4. Author-role users can sticky posts

A permissions weakness letting users with the Author role make posts sticky — something that should be restricted to Editors and above. Reported by Anthropic. If your site has Author accounts for guest posters or freelance writers, one of them could (deliberately or accidentally) pin their post to the top of your blog. Minor, but exactly the sort of privilege creep that erodes trust in a multi-author setup.

5. Unauthenticated disclosure of comments on private and unpublished posts

This is the one to pay attention to. Anyone — no account, no login — could read comments associated with private or unpublished posts. Reported by Ananda Dhakal of Patchstack. If you run a membership site, a staging review workflow, or a private client-review blog where drafts hold sensitive discussion in the comments, those comments were visible before this fix. Update and assume the worst about anything sensitive discussed in comments on non-public posts.

6. XSS through Imgur embeds

Imgur embeds are vulnerable to cross-site scripting — a Contributor-level account could get a script executed when someone views the page. Reported by Zhengyu Liu, Jingcheng Yang, and Gavin Zhong. If you don’t use Imgur embeds, this is irrelevant to you. If you do, the update handles it — and it’s a reminder that every oEmbed provider you enable is a small amount of attack surface.

7. `{status}_{type}` hook name collision

Forgeable parameters passed to the {status}_{type} hook could cause action-name collisions. Reported by Alex Concha of the WordPress security team. This is plugin-dependent hardening: it only matters if a plugin passes a raw status or post type into wp_insert_post(). Normal site owners won’t interact with this directly; your plugins just get safer underneath you.

WordPress 7.1.3 bug fixes worth knowing about

The four bug fixes are listed as tickets in the 7.1.3 milestone rather than described in prose. Search Engine Journal’s coverage flags one as genuinely important: a critical flaw that could make image uploads fail with a fatal error. Two others fix oEmbed endpoints returning 404 messages (one tied to a music promotion platform, one to an eCard humor site), and one fixes a bug where a website icon in the admin toolbar could blow up to gigantic proportions. The practical point stands: if a plugin or theme behaves differently after the update, the Trac milestone ticket list is the first place to look — but for the overwhelming majority of sites, these are invisible.

Do you need to update right now?

Yes, promptly — but not in a panic. Patchstack’s take is the right calibration: two of the fixes start with an unauthenticated visitor (the comment-disclosure leak and, with a moderator click, the comments XSS), three need Contributor or Author accounts, one needs an administrator running an export, and one is plugin-dependent hardening. This is not a drop-everything emergency like the October 6 CVE-2026-87902 flaw that 7.1.2 patched (that one allowed unauthenticated visitors to trigger a local file inclusion, potentially leading to remote code execution). It is, however, a “today, with a plan” update — especially if you have comments open, multiple user roles, or private posts with discussion in the comments.

Two extra notes: the fixes are being backported to all branches eligible for security fixes, currently back to WordPress 4.7, with backports shipping as they become ready. But only the most recent version is actively supported — running a decade-old branch on backported fixes is not a strategy, it is a warning.

How to update to WordPress 7.1.3 safely

Step 1: Check your current version

In wp-admin, go to Dashboard → Updates, or glance at the admin footer. With WP-CLI, run wp core version. Most sites will already be on 7.1.3 or installing it, because minor security releases install automatically by default.

Step 2: Take a backup

A full backup — database plus files — before you touch anything. If your host has one-click backups, use it; if you use a plugin, run it now; if you manage the server, wp db export plus a file copy takes two minutes and has saved more site owners than any security plugin.

Step 3: Update from the dashboard

Go to Dashboard → Updates and click Update Now. That’s it for core. The update rewrites core files; your content, plugins, and theme are untouched.

Step 4: Update with WP-CLI (if you have SSH)

On a VPS or anywhere with shell access, WP-CLI is the cleaner route:

wp core update
wp core verify-checksums

The first command pulls and applies 7.1.3; the second verifies every core file against the official checksums, so you know nothing is tampered with or half-written. Run wp core update-db afterwards only if WordPress prompts you — for a minor release like this, it almost never does.

Step 5: Check that automatic updates are on

Minor security releases are supposed to install themselves. If yours didn’t, something is suppressing them — check your host’s update manager and look for WP_AUTO_UPDATE_CORE in wp-config.php. If it is set to false, your site is manually managed and you need a recurring reminder instead of relying on the machine. For a single personal site, leaving the default (automatic minor updates) is the right call.

Step 6: Smoke-test the money pages

After updating, don’t just stare at the homepage. Test what earns you money or collects leads: the checkout flow, the contact form, the booking widget, the download link. On a WooCommerce site, place a small test order. Minor releases rarely break things, but the ten minutes of testing is cheaper than discovering a broken checkout from a customer.

Updating across client sites (freelancers, read this)

If you maintain sites for clients, 7.1.3 is easy billable diligence: backup, wp core update, wp core verify-checksums, smoke-test, log it. Batch the sites that share a stack, do the complex ones individually, and document the result per site — a one-line changelog entry per client (“Updated to WordPress 7.1.3, verified checksums, checkout tested”) is the difference between invisible maintenance and visible professionalism. This kind of release is also legitimate acquisition bait: a short email to past clients — “WordPress shipped a security release this week; I’ve already patched your site” — reminds them why they keep you around. For the full triage mindset, see our guide to checking and patching CVE-2026-87902 from the previous release.

WordPress 7.1.3 Security Update: What Each Fix Means and How to Update Safely (2026)

WordPress 7.1.3: the seven security fixes, explained

1. Stored XSS on the Comments admin page (via pending comments)

2. Denial of service in `WP_Http::make_absolute_url()`