The WordPress 7.1.3 security update was released on 6 October 2026. It fixes 7 security issues and 4 bugs, including a stored XSS flaw on the Comments admin screen and a leak of comments on private posts. Everyone should update from Dashboard > Updates after taking a backup. Sites that embed Imgur content should also clear their caches.
Two weeks after the critical 7.1.2 patch, WordPress shipped another security release. The WordPress 7.1.3 security update is not an all-hands emergency like its predecessor, and none of the sources we checked reports active exploitation. It still closes seven holes, and a few of them only matter on sites with certain user roles.
If you already read our WordPress 7.1.2 security update guide, the routine is the same. Below we cover what each fix does in plain English, who is actually exposed, how to update safely, and the one cleanup step the update does not do for you.
What the WordPress 7.1.3 security update fixes
The official announcement lists seven security fixes and four bug fixes. Patchstack has a useful write-up of the conditions behind each one, and we have combined the two below.
| Fix | What has to be true to be at risk |
|---|---|
| Stored XSS on the Comments admin page | A pending comment with a crafted link, and an Editor or higher clicking it |
Denial of service in WP_Http::make_absolute_url() |
A Contributor or higher account using the block editor’s link preview |
| Second-order SQL injection in WXR export | An admin exporting a single content type while a malformed _thumbnail_id value exists in the database |
| Author-role users could make posts sticky | An Author account or higher |
| Comments on private and unpublished posts visible to anyone | No login needed |
| XSS in Imgur embeds | A Contributor or higher account, and someone viewing the embed |
Forgeable parameters in the {status}_{type} hook |
A plugin that passes a raw status or post type into wp_insert_post() |
WordPress did not publish severity scores with the announcement, so we are not going to invent any. The reporters include Trail of Bits working with OpenAI, Anthropic, and Patchstack’s Ananda Dhakal.
Who is actually exposed
The only fix that works without any account is the comment leak. On a site where private or unpublished posts have comments, an unauthenticated visitor could see them. Patchstack notes that the feed printed those comments because the check cleared the post but not its comments, and feeds do not return a 404 the way a page would. A public homepage that looks normal tells you nothing here.
The Comments screen XSS is the one moderators should care about. The attack starts with an unauthenticated visitor leaving a comment, but it only works if a moderator then clicks the crafted link in the pending queue. Most of the others need at least a Contributor account, so the more people you have with editing roles, the more this release matters. Patchstack suggests auditing who holds Contributor or higher roles, which is a good habit anyway.
The WXR export bug is narrow. Patchstack says the default “All content” export does not reach the vulnerable code, and it needs a malformed thumbnail value already sitting in the database.
How to update to WordPress 7.1.3 safely
WordPress recommends updating immediately because this is a security release. On most sites the background updater will do it for you, but confirm it rather than assume.
- Take a full backup of the files and database. Your host’s backup tool or a backup plugin both work.
- Go to Dashboard > Updates. If you see Update to version 7.1.3, click Update Now.
- If the button is missing, check the version line. A site that already reads 7.1.3 is done.
- Wait for the process to finish, then open the front end and the Posts and Comments screens to check they load.
If the one-click update fails, WordPress’s own documentation says the usual cause is file permissions. If a “failed update” notice appears, delete the .maintenance file from the WordPress folder over FTP and try again, or follow the manual update steps in the official guide.
Running an older branch?
The release notes say the fixes are also available for older affected branches, and the announcement says backports go through branch 4.7 and are shipping as each one is ready. Only the newest WordPress version is actively supported, so check Dashboard > Updates for the number your branch should be on, and plan a move to 7.1 when you can.
Test custom code before updating a live site. The release notes list nine changed files, including the REST posts controller, the Customizer classes, class-wp-query.php and the export code. If a custom plugin touches any of those areas, try the update on staging first.
The cleanup step the update does not do: clear your caches
The 7.1.3 update stops new malicious Imgur embeds from being stored, but it does not remove ones already saved. Patchstack points out that existing cached oEmbed data (_oembed_* post meta and oembed_cache posts) keeps rendering until it is cleared. If your site embeds third-party content, clear the caches after updating.
Clear your page cache, any CDN cache, and the object cache, in that order. Our guide to clearing Elementor and page caches in the right order shows each layer. If you use Cloudflare, purge it too after the page cache.
One bug fix worth knowing about: image uploads on hosts without ext-dom
Search Engine Journal reports that one of the four bug fixes is rated critical on the WordPress ticket tracker. It is not a security flaw. Since WordPress 7.0, image uploads could fail with a fatal error on hosts without PHP’s DOM extension (ext-dom). SEJ says a core committer considered this probably rare, since the code had shipped for 134 days before the first report. If uploads broke on your server after a 7.0 update, this release should fix it. The official announcement links the full bug list on the Trac report.
Post-update checklist
| Check | Where | Why |
|---|---|---|
| Version shows 7.1.3 (or your branch’s patched number) | Dashboard > Updates | Confirms the patch landed |
| Review users with Contributor or higher roles | Users > All Users | Most fixes need one of these accounts |
| Look through pending comments | Comments | Remove anything with odd links before opening it |
| Test an image upload | Media > Add New | Confirms uploads work |
| Clear page, CDN and object caches | Your cache plugin and Cloudflare | Clears old embed data |
Update to WordPress 7.1.3 after a backup, confirm the version in Dashboard > Updates, tidy up Contributor and Author accounts, and clear every cache so old oEmbed data does not linger. We found no report of active exploitation, but seven fixes in one release is a good reason not to wait.
Frequently asked questions
Is WordPress 7.1.3 a security release?
Yes. The official announcement calls it a maintenance and security release with 7 security fixes and 4 bug fixes, and recommends updating immediately.
Will WordPress 7.1.3 update automatically?
On sites that support background updates, WordPress says the process will begin automatically. Check Dashboard > Updates to be sure, because hosts and config settings can block it.
Do I need to update if I only have Admin users and no comments?
Yes. Even if some fixes need roles you do not use, the update is small, covers core files only, and the project recommends installing it right away.
Does the update fix older WordPress versions too?
WordPress says security fixes are being backported to all branches eligible for them, currently through 4.7, as each is ready. Only the latest version is actively supported.
Do I need to clear my cache after updating?
It is a good idea. Patchstack warns that the update does not remove oEmbed content already cached, so clear your caches after updating.
Sources: WordPress.org: 7.1.3 Maintenance and Security Release; WordPress.org: Version 7.1.3 release notes; WordPress.org: Updating WordPress; Patchstack: WordPress 7.1.3 security release; Search Engine Journal. Checked October 2026.
More in Software & Tools
Cloudflare SSL Modes Explained: Which One to Use
Cloudflare SSL modes control the link between Cloudflare and your server. See what Flexible, Full and Full (strict) do and which one fits your host.
Shopify Automated Policies: What Changed and What to Check
Shopify can now write and update your store policies for you. See what changed on 8 October 2026, who it affects, and what to check before you switch it on.
Google September 2026 Spam Update: What Site Owners Should Check
Google's September 2026 spam update began on 24 September. Here's how to tell if your site was hit, and the five WordPress checks worth running right now.