WordPress 7.1.3 shipped on October 6, 2026, as a security and maintenance release. It’s a smaller update than a feature release, but it closes seven distinct security issues plus one notable bug — and a few of the details are worth understanding rather than just clicking “update.”
The seven security fixes
- Stored XSS on the Comments admin screen, reachable through pending comments. It requires a logged-in moderator to click a malicious link for the payload to fire — not a drive-by, but still dangerous on sites where comment moderation is handled by multiple people.
- A denial-of-service issue, details of which are being kept intentionally light by reporting outlets until patch adoption is higher.
- Second-order SQL injection in the WXR export tool. This one only triggers when exporting a single content type rather than using the default “All content” export — a narrow but real attack surface for sites that rely on selective exports.
- An author-role weakness that let users with the Author role make their own posts sticky, a privilege normally reserved for editors and above.
- Leaked comments on private and unpublished posts, visible to any visitor who knew where to look — a straightforward information-disclosure bug.
- An Imgur embed XSS, fixed in most reporting by removing Imgur oEmbed support outright rather than attempting to sanitize it further.
- Forgeable parameters in a post-status hook that could cause action name collisions, a more obscure core-internals issue but still worth patching.
Notably, three of the seven issues — including the WXR export SQL injection — were reported by Anthropic, a detail several outlets flagged given the AI company doesn’t typically appear as a WordPress security researcher.
The non-security bug fix
7.1.3 also fixes a bug that could cause a fatal error during image uploads on hosting environments missing an optional PHP component (reporting differs on whether this is the DOM extension specifically). If your site has intermittently failed to process image uploads on certain hosts, this release may be the fix — though it’s described inconsistently enough across outlets that you should test uploads after updating rather than assuming it’s resolved.
What this release doesn’t do
No outlet reporting on 7.1.3 has confirmed active exploitation or a public proof-of-concept for any of these seven issues as of this release — unlike the wp2shell core RCE chain patched in 7.0.2 and the Bricksforge plugin flaw making headlines the same week. That’s a meaningful difference: these are “patch during normal maintenance” issues rather than “patch today” issues. WordPress itself has not assigned individual CVE numbers to these fixes in its release notes, which is typical for minor core security releases.
Should you update?
Yes, on your normal update cadence rather than as an emergency. If you’re already on 7.1.2 (released in September), moving to 7.1.3 closes real issues without the urgency of an actively-exploited core RCE. As always: updating core patches the vulnerabilities going forward but does nothing to clean a site that was already compromised through one of these bugs, so if you’ve seen symptoms matching any of the above — stray admin-sticky posts from Author accounts, unexplained comment visibility issues — investigate before assuming the update alone resolved it.