WordPress released version 7.1.3 on 6 October 2026, a combined maintenance and security update fixing seven security issues and four bugs. Businesses running WordPress should confirm their sites now report 7.1.3, update any that do not, and use the same session to check plugins and their host's PHP version.
None of the seven issues is described by WordPress as being exploited, but several are the kind attackers routinely look for, such as cross-site scripting and SQL injection. Updating takes minutes; cleaning up after a compromise takes much longer.
Key takeaways
- WordPress 7.1.3 was released on 6 October 2026 with seven security fixes and four bug fixes.
- The fixes include a stored XSS on the Comments admin page and a second-order SQL injection in WXR export.
- Sites with automatic background updates should update themselves, but you should confirm the version rather than assume.
- A WordPress update does not patch PHP, so check the separate 21 October 2026 PHP security release with your host too.
What happened
The WordPress 7.1.3 announcement, dated 6 October 2026, lists these security fixes:
| Issue | What it means in plain English |
|---|---|
| Stored XSS on the Comments admin page via pending comments | A malicious comment could run script when an admin views comments |
Denial of service in WP_Http::make_absolute_url() |
A crafted request could tie up the server |
| Second-order SQL injection in WXR export | Data stored earlier could be used to tamper with database queries during export |
| Author-role users could sticky posts | A permissions gap for lower-level accounts |
| Unauthenticated disclosure of comments on private and unpublished posts | Comments meant to stay hidden could be read by outsiders |
| XSS in Imgur embeds | Script injection through embedded content |
Forgeable parameters passed to the {status}_{type} hook |
Could cause action name collisions in code that relies on the hook |
The release also contains four bug fixes. WordPress says security fixes are being backported to all eligible branches, currently through 4.7, and that "the backports are in progress and will ship as they become ready". It also notes that "only the most recent version of WordPress is actively supported" and recommends updating "immediately".
For sites with automatic background updates, WordPress says "the update process will begin automatically".
How this connects to the PHP release
Two weeks later, on 21 October 2026, the PHP project shipped critical fixes for PHP itself. That is a separate problem on the server, not in WordPress. Updating to 7.1.3 does not fix it. Our PHP security release guide covers what to ask your host.
Who this affects
- Any business site on WordPress, from a trades brochure site to a WooCommerce shop. The comment-related fixes matter most if comments are switched on.
- Sites with several editors or authors. The Author-role permission fix shows why user roles deserve regular review.
- Agencies and freelancers managing many installs. Auto-updates can fail silently on some hosting setups, so a fleet check is worth doing.
- Businesses that have switched off auto-updates because a plugin once broke. They will need to update by hand.
In the UK, if you are working towards or renewing Cyber Essentials, the scheme expects high-risk or critical updates, including CMS updates, within 14 days of release. Our Cyber Essentials 2026 changes post explains the rule.
Practical checklist
- Check the version. In the WordPress dashboard, go to Dashboard, then Updates. It should say you have the latest version, 7.1.3 or newer.
- Take a backup first. Even minor releases can clash with old plugins. See our website backup guide.
- Update core, then plugins and themes. Clear any caching plugin or CDN cache afterwards.
- Review pending comments carefully. Delete obvious spam rather than opening each one, and consider turning comments off on pages that do not need them.
- Audit user accounts. Remove old staff, freelancers and test accounts. Make sure only people who need it have Editor or Administrator access, and turn on two-factor authentication for admin logins.
- Check your PHP version with your host, given the separate 21 October PHP fixes.
- Confirm nothing broke. Load key pages, submit your contact form and run a test checkout. Our free broken link checker and website down checker catch the obvious failures.
- Recheck your headers. Updates are a good moment to make sure security headers survived. Run your homepage through the security headers checker.
For a fuller review, work through our WordPress security checklist or how to audit a WordPress site. If keeping on top of updates is eating time every month, Make It Flow can help you set up monitoring and update reports so a person only steps in when something needs a decision; talk to us if that would help.
FAQ
Will my WordPress site update to 7.1.3 automatically?
If automatic background updates are enabled, WordPress says the update will begin automatically. Many hosts also manage updates. But auto-updates can be disabled by a plugin, a host setting or a file permission problem, so always confirm the version in Dashboard, then Updates, rather than assuming.
Is WordPress 7.1.3 being actively exploited?
The WordPress announcement does not say any of the seven issues are being exploited. That can change once fixes are public, because attackers can study what was patched. Updating promptly is the simplest way to stay ahead.
I run an older WordPress branch. Will I get the fixes?
WordPress says security fixes are being backported to eligible branches, currently through 4.7, as they become ready. However, only the latest version is actively supported, and old branches often mean old PHP and old plugins. Plan a move to the current release.
Does updating WordPress also protect me from the October PHP vulnerabilities?
No. The 21 October 2026 PHP flaws are in the server software that runs WordPress. You need your host to install PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a patched vendor build. Check both separately.
Should I turn off comments to be safe?
Not necessarily. Once you are on 7.1.3 the specific comment issues are fixed. But if comments add little to your business site and attract mostly spam, turning them off reduces your attack surface and moderation time. It is a reasonable choice for many small business sites.
Related reading
- Website Security Threats 2026: A UK Small Business Guide: The biggest website security threats for UK small businesses in 2026, backed by government breach data, plus a practical checklist to cut your risk this month.
- WordPress 7.2 Beta 1: What Site Owners Should Test Before December: WordPress 7.2 Beta 1 arrived on October 20, 2026, ahead of a December 8 release. What changes for editors, admin speed and developers, and how to test safely.
Sources
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 27 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
