WordPress has released a new security and maintenance version, and every site owner should pay attention. The WordPress 7.1.3 update arrived on October 6, 2026, with 7 security fixes and 4 bug fixes. In this post, we explain what was fixed in plain language, who needs to update, and how to update your site safely without breaking anything.
What Is the WordPress 7.1.3 Update?
WordPress 7.1.3 is a minor release in the 7.1 branch. The 7.1 major version came out on August 19, 2026, and 7.1.3 is its third maintenance release. Minor releases do not add big new features. Instead, they patch security holes and fix bugs.
According to the official WordPress 7.1.3 release post, this release contains 7 security fixes and 4 bug fixes. The release was led by Jake Spurlock, with help from dozens of core contributors.
Most importantly, the WordPress team says that, because this is a security release, you should update your sites immediately.
Security Fixes in the WordPress 7.1.3 Update
The security team listed seven issues that were responsibly reported and fixed. Here is each one, with a short explanation of what it means for a normal site owner.
1. Stored XSS on the Comments Admin Page
A stored cross-site scripting (XSS) issue on the Comments administration page could be exploited through pending comments. In simple terms, a harmful script hidden in a comment could run when an admin viewed it. It was reported by Trail of Bits in collaboration with OpenAI.
2. DoS Issue in WP_Http::make_absolute_url()
A denial of service (DoS) issue was found in the WP_Http::make_absolute_url() method. A DoS bug can slow a site down or make it stop responding. Anthropic reported this issue.
3. Second-Order SQL Injection in WXR Export
A second-order SQL injection affected the WordPress WXR export, which is the tool behind Tools > Export. SQL injection bugs can let bad input reach the database in unsafe ways. Anthropic reported this one too.
4. Author Users Could Sticky Posts
A weakness allowed users with the Author role to make posts sticky. Normally, that is not an Author’s job. Although this sounds small, it is a permissions problem, so it matters on multi-author sites. Anthropic reported it.
5. Comments on Private Posts Could Be Disclosed
Comments on private and unpublished posts could be disclosed without logging in. As a result, private discussion might have been visible to outsiders. Ananda Dhakal from Patchstack reported this issue.
6. XSS in Imgur Embeds
Imgur embeds were vulnerable to cross-site scripting. Zhengyu Liu, Jingcheng Yang and Gavin Zhong reported it.
7. Forgeable Parameters in the {status}_{type} Hook
Finally, forgeable parameters passed to the {status}_{type} hook could lead to an action name collision. This was reported by Alex Concha of the WordPress security team.
The official post does not rate the severity of each issue. Even so, the advice is clear: update now.
What About Older WordPress Versions?
If your site still runs the 7.0 branch, you are not left behind. On the same day, WordPress released version 7.0.7 with the same seven security fixes.
In addition, the security fixes are being backported, where necessary, to all branches eligible for security fixes, currently through version 4.7. However, the WordPress team reminds users that only the most recent version is actively supported. Therefore, the best choice is to move to 7.1.3 if your theme and plugins support it. You can see every version on the WordPress releases page.
Will My Site Update Automatically?
Possibly. If your site supports automatic background updates, the update process will start on its own. Many hosts enable this for minor releases.
Still, do not assume it happened. Go to Dashboard > Updates and check the version number. If it does not say 7.1.3, you need to install the WordPress 7.1.3 update manually.
How to Install the WordPress 7.1.3 Update Safely
Minor updates are usually smooth. Even so, a few minutes of preparation can save you hours of stress. Follow these steps.
Step 1: Take a Full Backup
First, back up your files and your database. If anything goes wrong, you can restore your site quickly. A plugin like UpdraftPlus Premium lets you run a backup with one click and store it in the cloud, such as Google Drive or Dropbox.
Step 2: Check Your Theme and Plugins
Next, make sure your theme and main plugins are up to date. Outdated add-ons cause most update problems. Also, if you use premium files from a GPL source, check that they are clean copies. Our guide on GPL vs nulled themes explains how to stay safe.
Step 3: Test on Staging (Recommended)
If your host offers a staging site, apply the update there first. Then click through your key pages, forms and checkout. This step is optional for small blogs. However, it is a smart habit for stores and business sites.
Step 4: Run the Update
Now, go to Dashboard > Updates and click Update Now. Alternatively, you can download WordPress 7.1.3 from WordPress.org and upload it manually. The official Updating WordPress guide covers both methods.
Step 5: Clear Cache and Test
After the update, clear your caching plugin and any server or CDN cache. Then open your homepage, a post, your contact form and, if you have one, your shop. Finally, log out and log back in to confirm that everything works.
What If Something Breaks?
Problems after a minor release are rare. Still, if your site shows an error, stay calm and try these steps:
- Deactivate plugins one by one to find the cause.
- Switch to a default theme for a moment to test your theme.
- Check your hosting error log for the exact message.
- If needed, restore the backup you made in Step 1.
Once your site is stable again, update the plugin or theme that caused the issue, then try once more.
Why Small Security Releases Matter
Many site owners skip minor updates because they look boring. That is a mistake. Once fixes are public, attackers can study them and target sites that have not updated yet. In other words, an unpatched site becomes an easier target over time.
Moreover, security is a chain. Core updates, clean themes, updated plugins and regular backups all work together. If one link is weak, the whole site is at risk.
Frequently Asked Questions
When was WordPress 7.1.3 released?
It was released on October 6, 2026, as a security and maintenance release.
How many fixes does the WordPress 7.1.3 update include?
The official release post lists 7 security fixes and 4 bug fixes.
Is WordPress 7.1.3 safe to install?
Yes. It is the version the WordPress team recommends, and they advise updating immediately. As always, take a backup first.
I am on WordPress 7.0. What should I do?
Update to at least 7.0.7, which contains the same security fixes. When your theme and plugins are ready, move to the latest 7.1 release, since only the most recent version is actively supported.
Final Thoughts
To sum up, the WordPress 7.1.3 update is a small release with an important job. It closes seven security issues, including XSS, SQL injection and private data disclosure. Back up your site, check your theme and plugins, run the update, and test your key pages. It only takes a few minutes, and it keeps your site much safer.
Looking for trusted tools to build and protect your site? Browse our collection of GPL themes and plugins.
1 Comment. Leave new
[…] Before a WordPress core update, such as the recent WordPress 7.1.3 update. […]