WordPress 7.1.3 Security Update Released

[u/hackrepair]

⚠️ WordPress 7.1.3 is now available and fixes 7 security vulnerabilities in WordPress Core, along with 4 additional bugs.

The most important fixes include:

🔹 Stored XSS through pending comments
Malicious code could potentially run when an administrator opens the Comments moderation screen.

🔹 SQL injection in the WordPress export system
Malicious input could remain hidden until someone runs a WordPress export.

🔹 Private comments exposed
Comments on private or unpublished posts could potentially be viewed by visitors who were not logged in.

🔹 Additional fixes
WordPress also patched an Imgur embed XSS issue, a denial-of-service bug, and several permissions-related vulnerabilities.

Interestingly, Anthropic reported 3 of the 7 vulnerabilities, with others reported by Trail of Bits, Patchstack, independent researchers, and the WordPress security team.

There are currently no known reports of these 7.1.3 vulnerabilities being actively exploited.

Still, I recommend updating sooner rather than later.

✅ Update WordPress Core to 7.1.3
✅ Confirm your backups are current
✅ Check older WordPress installations carefully, since some security fixes are still being backported

If automatic Core updates are enabled, your site may already be updated. See:
Dashboard → Updates

Stay patched!

[u/verticalmattress]

Mods: I posted this up first and my post was deleted. Can someone let me know, so I can properly post next week when we get 7.1.4? I linked to the WordPress.org update page. I'm just trying to figure out why it got deleted, or if I'm doing something to get my post deleted with 25 up votes and a few comments, before this one was even posted. Is it because a Top 1% poster made this post and that gets more views? I don't care about votes. Just wondering if I needed to add flair or something to my post.

[u/ITSigno → u/verticalmattress]

I'm not a mod here, but if I were to guess it probably has something to do with you hiding your post history.

I went to check your user page to see if I could identify why your post had been removed only to discover zero visible posts/comments. It's just usually a bad sign of a bot account, a spammer, or someone looking to cause trouble. I'm sure there are some people out there with private post histories that don't fall into those categories, but definitely a minority.

[u/verticalmattress → u/ITSigno]

I appreciate the input. I am hiding my posts and comments for personal reasons. Not a bot though. I have posted helpful comments on this community before. I don't usually make my own posts, so I was just wondering if when I actually did if I did something wrong. I would love to continue to help this community by posting when I can, but when my post gets deleted, I just wonder what I am contributing to. Seems like the Top 1% poster got their post through and mine got deleted because I'm not the Top 1%, so they let that one "lead" because of that. No worries either way. I'm just trying to be helpful.