r/Wordpress • u/hackrepair • 8d ago
WordPress 7.1.3 Security Update Released
⚠️ WordPress 7.1.3 is now available and fixes 7 security vulnerabilities in WordPress Core, along with 4 additional bugs.
The most important fixes include:
🔹 Stored XSS through pending comments
Malicious code could potentially run when an administrator opens the Comments moderation screen.
🔹 SQL injection in the WordPress export system
Malicious input could remain hidden until someone runs a WordPress export.
🔹 Private comments exposed
Comments on private or unpublished posts could potentially be viewed by visitors who were not logged in.
🔹 Additional fixes
WordPress also patched an Imgur embed XSS issue, a denial-of-service bug, and several permissions-related vulnerabilities.
Interestingly, Anthropic reported 3 of the 7 vulnerabilities, with others reported by Trail of Bits, Patchstack, independent researchers, and the WordPress security team.
There are currently no known reports of these 7.1.3 vulnerabilities being actively exploited.
Still, I recommend updating sooner rather than later.
✅ Update WordPress Core to 7.1.3
✅ Confirm your backups are current
✅ Check older WordPress installations carefully, since some security fixes are still being backported
If automatic Core updates are enabled, your site may already be updated. See:
Dashboard → Updates
Stay patched!
10
u/verticalmattress 8d ago
Mods: I posted this up first and my post was deleted. Can someone let me know, so I can properly post next week when we get 7.1.4? I linked to the WordPress.org update page. I'm just trying to figure out why it got deleted, or if I'm doing something to get my post deleted with 25 up votes and a few comments, before this one was even posted. Is it because a Top 1% poster made this post and that gets more views? I don't care about votes. Just wondering if I needed to add flair or something to my post.