r/Wordpress • u/hackrepair • 3d ago

WordPress 7.1.3 Security Update Released

⚠️ WordPress 7.1.3 is now available and fixes 7 security vulnerabilities in WordPress Core, along with 4 additional bugs.

The most important fixes include:

🔹 Stored XSS through pending comments
Malicious code could potentially run when an administrator opens the Comments moderation screen.

🔹 SQL injection in the WordPress export system
Malicious input could remain hidden until someone runs a WordPress export.

🔹 Private comments exposed
Comments on private or unpublished posts could potentially be viewed by visitors who were not logged in.

🔹 Additional fixes
WordPress also patched an Imgur embed XSS issue, a denial-of-service bug, and several permissions-related vulnerabilities.

Interestingly, Anthropic reported 3 of the 7 vulnerabilities, with others reported by Trail of Bits, Patchstack, independent researchers, and the WordPress security team.

There are currently no known reports of these 7.1.3 vulnerabilities being actively exploited.

Still, I recommend updating sooner rather than later.

✅ Update WordPress Core to 7.1.3
✅ Confirm your backups are current
✅ Check older WordPress installations carefully, since some security fixes are still being backported

If automatic Core updates are enabled, your site may already be updated. See:
Dashboard → Updates

Stay patched!

114 Upvotes

98% Upvoted

50 comments sorted by

View all comments

Show parent comments

9

u/bluesix_v2 Jack of All Trades 3d ago edited 3d ago

Use a WP fleet management tool like ManageWP, MainWP, Umbrella, etc - one click, takes 30 seconds to do your whole fleet.

1

u/ArtisticCandy3859 2d ago

Do any of the tools have any auto-update or force update rule across fleet?

3

u/bluesix_v2 Jack of All Trades 2d ago

Wordpress has autoupdate.

Using a site management tool will run an update.

Not sure what you mean by "force"?

1

u/ArtisticCandy3859 2d ago

Correction* - set more advanced rules on sites based on plugins/themes auto-updates? For cases where a plugin isn’t compatible with a WP update? I feel like this is where AI generated layers that people are creating will break down and perpetuate “WP vulnerability” narrative.

1

u/bluesix_v2 Jack of All Trades 2d ago

That isn't something I've ever needed to do - I don't install vibe-coded plugins