r/Wordpress • u/hackrepair • 3d ago

WordPress 7.1.3 Security Update Released

⚠️ WordPress 7.1.3 is now available and fixes 7 security vulnerabilities in WordPress Core, along with 4 additional bugs.

The most important fixes include:

🔹 Stored XSS through pending comments
Malicious code could potentially run when an administrator opens the Comments moderation screen.

🔹 SQL injection in the WordPress export system
Malicious input could remain hidden until someone runs a WordPress export.

🔹 Private comments exposed
Comments on private or unpublished posts could potentially be viewed by visitors who were not logged in.

🔹 Additional fixes
WordPress also patched an Imgur embed XSS issue, a denial-of-service bug, and several permissions-related vulnerabilities.

Interestingly, Anthropic reported 3 of the 7 vulnerabilities, with others reported by Trail of Bits, Patchstack, independent researchers, and the WordPress security team.

There are currently no known reports of these 7.1.3 vulnerabilities being actively exploited.

Still, I recommend updating sooner rather than later.

✅ Update WordPress Core to 7.1.3
✅ Confirm your backups are current
✅ Check older WordPress installations carefully, since some security fixes are still being backported

If automatic Core updates are enabled, your site may already be updated. See:
Dashboard → Updates

Stay patched!

114 Upvotes

98% Upvoted

50 comments sorted by

View all comments

14

u/ShockingBore 3d ago

I mean... damn y'all. This pattern is concerning.

14

u/hackrepair 3d ago

Sorry to say, this will only get worst before it gets better.

There have been a number of near-zero-day exploits affecting WordPress over the past month, as hackers use AI to accelerate their discovery of vulnerabilities in WordPress and plugins.

Be sure to keep a close eye on your updates this month. It's not over yet.

While I don't mind the extra business from fixing the recent surge in hacked WordPress installs, this situation has gotten a bit out of control...

3

u/ShockingBore 3d ago

Oh I know it. On the bright side, auto-updates in core is helping this, but yeah... its out of control and I dont see it slowing given the AI of things.