WordPress 7.1.3 was released on October 6, 2026. This security and maintenance release includes 7 security fixes and 4 bug fixes, and the recommendation is to update your sites immediately.
Security fixes in this release
The official announcement lists these responsibly reported issues:
- A stored XSS on the Comments administration page, exploitable through pending comments
- A denial of service issue in the WP_Http::make_absolute_url() method
- A second order SQL injection in the WordPress WXR export
- A weakness that let author level users make posts sticky
- Disclosure of comments on private and unpublished posts without logging in
- An XSS issue in Imgur embeds
- Forgeable parameters passed to a status and type hook that could lead to action name collisions
The security fixes were backported to all branches eligible for security fixes, back to 4.7 at the time of release.
How to update
Sites that support automatic background updates receive it on their own. You can also go to Dashboard, then Updates, and click Update Now.
Comment moderation and WXR exports after WordPress 7.1.3
Sites that moderate comments are the clearest beneficiaries, since the most visible fix closes a path through pending comments into the admin area. Teams that use the WordPress export tool for migrations or backups should also update before running another export.
Stored XSS via pending comments. A pending comment is supposed to wait quietly for review, but this issue could let one run script when a moderator opened the Comments screen. Sites that moderate a lot of comments should update first. After updating, we open the Comments screen on staging and confirm moderation works as expected.
Denial of service in WP_Http::make_absolute_url(). This method turns relative links into full addresses, and the weakness could be used to slow a site down or take it offline. The fix needs no changes on your end, and we keep a close eye on uptime monitoring after rolling it out.
Second order SQL injection in the WXR export. The WXR export is the tool many teams use for migrations and content backups. This injection could be triggered when stored data was later exported, so we update before running any export and confirm on staging that export files still import cleanly.
Authors making posts sticky. Sticky posts stay pinned to the top of a blog or news page, so an author pinning their own post could push important announcements down. The fix keeps that decision with editors and administrators, and we check your sticky posts after updating to make sure the right ones are featured.
Comments on private and unpublished posts. Comments on private or unpublished posts could be read without logging in, which matters for sites that use private posts for internal updates or client work. We confirm those comments are no longer visible to logged out visitors once the update is in place.
XSS in Imgur embeds. If your posts embed Imgur images or galleries, this fix keeps script out of those embeds. We open a few posts with Imgur embeds after updating to make sure they still display correctly.
Forgeable parameters in a status and type hook. Forged parameters could make this hook fire under the wrong action name, which could trigger code meant for something else. It matters most on sites with custom plugins that react to post status changes, so we retest those workflows, like notifications and integrations, on staging.
Four bug fixes. The four bug fixes are small, and we apply them together with the security fixes after our staging checks of your key pages and forms.
Want WordPress 7.1.3 and every release after it handled for you? Our support and maintenance plans cover tested core, theme and plugin updates, uptime monitoring and help when something breaks. Questions about your site? Contact us and we will take a look.
