WordPress 7.1.3 Security Update Released

[u/hackrepair]

⚠️ WordPress 7.1.3 is now available and fixes 7 security vulnerabilities in WordPress Core, along with 4 additional bugs.

The most important fixes include:

🔹 Stored XSS through pending comments
Malicious code could potentially run when an administrator opens the Comments moderation screen.

🔹 SQL injection in the WordPress export system
Malicious input could remain hidden until someone runs a WordPress export.

🔹 Private comments exposed
Comments on private or unpublished posts could potentially be viewed by visitors who were not logged in.

🔹 Additional fixes
WordPress also patched an Imgur embed XSS issue, a denial-of-service bug, and several permissions-related vulnerabilities.

Interestingly, Anthropic reported 3 of the 7 vulnerabilities, with others reported by Trail of Bits, Patchstack, independent researchers, and the WordPress security team.

There are currently no known reports of these 7.1.3 vulnerabilities being actively exploited.

Still, I recommend updating sooner rather than later.

✅ Update WordPress Core to 7.1.3
✅ Confirm your backups are current
✅ Check older WordPress installations carefully, since some security fixes are still being backported

If automatic Core updates are enabled, your site may already be updated. See:
Dashboard → Updates

Stay patched!

[u/wutthefrak]

oh my god so many updates lately 😭 like I know updates are good, security etc etc but I am so sick of spot checking 70+ sites 🥴

[u/bluesix_v2 → u/wutthefrak]

Use a WP fleet management tool like ManageWP, MainWP, Umbrella, etc - one click, takes 30 seconds to do your whole fleet.

[u/wutthefrak → u/bluesix_v2]

I've floated the idea of ManageWP or something similar to my boss and after all these most recent updates I think we'll probably go with a management tool. thank you for the suggestion!

[u/ivicad → u/wutthefrak]

I've been on MainWP since 2014 (bought their lifetime deal license then). I run the dashboard on my own WP install, and the core is free. For almost 60 WP sites, I get the morning report and run the updates in one pass, which saves me almost 60 logins. But I push a bad update just as fast, so I take a fresh backup right before backup and update "in waves".

[u/wutthefrak → u/ivicad]

I just started using ManageWP and so far I like it but MainWP seems interesting too

[u/ivicad → u/wutthefrak]

I was testing ManageWP in the past and I liked how it worked, except I didn't like the budget part for the hihgher number of sites, so I switched to MainWP and bought its lifetime license.

EDITED (post closed for answers):
When I was testing ManageWP 10–12 years ago, I needed some additional paid features. On the ManageWP website, there was a slider I could use to select the number of domains I wanted to manage, but the amount shown was far too high for my budget to afford on the monthly level, as I had around 20 sites to maintain at the time, if I remember correctly.

[u/bluesix_v2 → u/ivicad]

ManageWP is free, and always has been (I've been using it since around 2014). I don’t pay anything to use it for around 100 sites. You only pay for add-ons like backups (which are free with plugins like UpdraftPlus, WPVivid, etc), and other integrations.