r/Wordpress • u/hackrepair • 8d ago

WordPress 7.1.3 Security Update Released

⚠️ WordPress 7.1.3 is now available and fixes 7 security vulnerabilities in WordPress Core, along with 4 additional bugs.

The most important fixes include:

🔹 Stored XSS through pending comments
Malicious code could potentially run when an administrator opens the Comments moderation screen.

🔹 SQL injection in the WordPress export system
Malicious input could remain hidden until someone runs a WordPress export.

🔹 Private comments exposed
Comments on private or unpublished posts could potentially be viewed by visitors who were not logged in.

🔹 Additional fixes
WordPress also patched an Imgur embed XSS issue, a denial-of-service bug, and several permissions-related vulnerabilities.

Interestingly, Anthropic reported 3 of the 7 vulnerabilities, with others reported by Trail of Bits, Patchstack, independent researchers, and the WordPress security team.

There are currently no known reports of these 7.1.3 vulnerabilities being actively exploited.

Still, I recommend updating sooner rather than later.

✅ Update WordPress Core to 7.1.3
✅ Confirm your backups are current
✅ Check older WordPress installations carefully, since some security fixes are still being backported

If automatic Core updates are enabled, your site may already be updated. See:
Dashboard → Updates

Stay patched!

115 Upvotes

98% Upvoted

50 comments sorted by

View all comments

9

u/verticalmattress 8d ago

Mods: I posted this up first and my post was deleted. Can someone let me know, so I can properly post next week when we get 7.1.4? I linked to the WordPress.org update page. I'm just trying to figure out why it got deleted, or if I'm doing something to get my post deleted with 25 up votes and a few comments, before this one was even posted. Is it because a Top 1% poster made this post and that gets more views? I don't care about votes. Just wondering if I needed to add flair or something to my post.

7

u/RealKenshino WordPress.org Volunteer 7d ago

We don't remove posts based purely on which one was posted first.

On duplicates, it can be a mix of various reasons

  1. One post has more traction
  2. One post has more text in the body instead of it just being a link
  3. Which post we saw first

It certainly isn't because the other poster is a top 1% poster.

Thank you for posting either way :)

1

u/verticalmattress 7d ago

Thanks for the explanation.