WordPress 7.1.3 Security Release

WordPress released version 7.1.3 on 6 October 2026, closing seven security holes alongside four bug fixes. Unlike the previous 7.1.2 update, which patched a single critical unauthenticated local-file-inclusion-to-RCE bug, this release addresses a mix of lower-severity issues: an unauthenticated stored XSS in pending comments that requires a moderator click, a feed leak exposing comments on private/unpublished posts to anyone, a denial-of-service in WP_Http::make_absolute_url() reachable by Contributor accounts, a second-order SQL injection in WXR exports triggerable by admins exporting content with a malicious _thumbnail_id, a privilege bug letting Authors sticky posts, an XSS via Imgur oEmbed embeds, and a hook-naming collision that could let a crafted post status/type fire unrelated action hooks like delete_post. None of these require urgent emergency action, but administrators should update promptly and review which users hold Contributor-or-higher roles, since several flaws depend on that access level. Sites using automatic updates will receive 7.1.3 automatically, and fixes have been backported through at least the 6.6 branch, though versions 4.7–6.5 remain unpatched for now.