WordPress 7.1.3 Released With Security and Maintenance Fixes

WordPress.org announced WordPress 7.1.3 on October 6, 2026, as a maintenance and security release for WordPress sites. According to WordPress.org, the update includes seven security fixes and four bug fixes, and site owners are advised to install it right away.

What changed

Version 7.1.3 addresses a range of security issues in core WordPress. The published list includes a stored XSS issue on the Comments administration page, a denial of service issue in the WP_Http::make_absolute_url() method, a second-order SQL injection issue in WordPress WXR export, a permissions weakness involving sticky posts for Author role users, unauthenticated disclosure of comments on private and unpublished posts, an XSS issue affecting Imgur embeds, and forgeable parameters passed to the {status}_{type} hook that can cause action name collision.

WordPress.org also said this release contains four bug fixes. Site owners can install 7.1.3 from the WordPress Dashboard under Updates, or download it directly from WordPress.org. For sites that allow automatic background updates, the process should begin automatically.

What it means for your website

If your business site runs WordPress, this update matters because it fixes multiple security problems in the core software. These issues affect areas tied to comments, exports, embeds, permissions, and internal hooks, so even a site that seems to be working normally could still benefit from the patch.

If you manage older WordPress branches, WordPress.org said the security fixes are being backported where needed to branches still eligible for security updates, currently through 4.7. At the same time, WordPress.org noted that only the most recent version of WordPress is actively supported.

What to do now

• Check your WordPress version and confirm whether your site is already on 7.1.3.
• If it is not updated yet, go to Dashboard, then Updates, and use Update Now.
• If your site uses automatic background updates, verify that the update completed successfully.
• If you run an older eligible branch, monitor for the backported security release for that branch.
• After updating, review normal site functions such as comments, embeds, and any export workflow you use.