WordPress has released WordPress 7.1.3, a maintenance and security update containing seven security fixes and four bug fixes. Because this is a security release, WordPress is recommending that site owners update immediately.
The release was published on October 6, 2026. WordPress 7.1.3 can be installed from the WordPress Dashboard under Updates or downloaded directly from WordPress.org. Sites configured for automatic background updates may begin receiving it automatically. WordPress 7.1.3 official release announcement
Seven security issues are fixed
The official WordPress security announcement lists seven separate issues addressed in the release. They span cross-site scripting, denial of service, SQL injection, authorization weaknesses and information disclosure.
One fix addresses a stored XSS issue in the Comments administration page that can be triggered through pending comments. Another resolves an XSS vulnerability involving Imgur embeds.
WordPress also fixed a denial-of-service issue in WP_Http::make_absolute_url() and a second-order SQL injection affecting WordPress WXR exports.
Anthropic reported several of the vulnerabilities
Three of the issues listed in the WordPress announcement were reported by Anthropic: the denial-of-service vulnerability, the second-order SQL injection issue and a weakness that allowed users with the Author role to make posts sticky.
Other researchers and organizations credited by WordPress include Trail of Bits, Patchstack researchers and members of the WordPress security community.
Private and unpublished comments could be exposed
Another security fix addresses unauthenticated disclosure of comments associated with private and unpublished posts.
Information-disclosure bugs can be particularly problematic on editorial, membership and staging-heavy WordPress installations because content that is intentionally outside the public publishing flow may still contain sensitive information.
A WordPress hook collision issue was also patched
The release additionally fixes forgeable parameters passed to the {status}_{type} hook that could result in an action-name collision.
Although individual vulnerabilities have different exploitation requirements and impacts, WordPress's recommendation is straightforward: because 7.1.3 is a security release, sites should be updated immediately.
Do not confuse 7.1.3 with the earlier 7.1.2 critical fix
WordPress 7.1.2 was released on September 22 with a separate critical-severity security fix. The official WordPress announcement for 7.1.3 describes seven security fixes but does not label one of these seven issues as a new critical vulnerability.
That distinction matters because third-party headlines can combine the current security release with discussion of the critical flaw addressed in the preceding version. Site owners should rely on the official release notes when assessing exactly what a particular WordPress version fixes.
Older supported branches are receiving backports
WordPress says the security fixes are being backported where necessary to branches that remain eligible for security updates, currently extending back through WordPress 4.7.
However, WordPress also emphasizes that only the latest version is actively supported. Running an older branch therefore should not be treated as equivalent to keeping a site on the current release.
Why security updates matter for SEO
A compromised WordPress installation can quickly become an SEO incident. Attackers may inject spam pages, alter internal links, add redirects, modify canonical tags, expose private content or serve malicious material to users and crawlers.
The resulting damage can include indexing pollution, reputation warnings, ranking losses and large-scale cleanup work.
That makes WordPress core security maintenance part of technical SEO operations rather than a task isolated to the security team.
What site owners should do now
Sites running WordPress should verify their current core version and update to 7.1.3. Before updating complex production environments, teams should ensure that recent backups exist and that critical themes and plugins remain compatible.
After the update, confirm that the site is serving normally, scheduled tasks are functioning, forms and authentication still work and no unexpected PHP or JavaScript errors have appeared.
For fleets of WordPress sites, administrators should also verify that automatic updates actually completed rather than assuming every installation received the release successfully.
The NetContentSEO takeaway
WordPress 7.1.3 is not a routine feature update. It is a security release fixing seven vulnerabilities alongside four maintenance bugs, and WordPress explicitly recommends immediate updating.
The SEO lesson is equally direct: core security is part of search visibility protection. A vulnerability that allows content manipulation, disclosure or site compromise can become an indexing and reputation problem long before it appears in an SEO dashboard.