WordPress 7.1.3: update your personal site for seven security fixes

If you run your own WordPress blog, a hobby site, a church page, or a personal project on self-hosted WordPress, treat WordPress 7.1.3 as a same-day update. It is a maintenance and security release, not a feature drop you can park for next weekend.

WordPress.org shipped 7.1.3 on October 6, 2026. The official news post counts 7 security fixes and 4 bug fixes. Because it is a security release, WordPress recommends updating sites immediately from Dashboard → Updates, or downloading the release and applying it the way you usually update. Automatic background updates may already be running if you left them on. Still log in afterward and confirm the version yourself.

This is a different package from the earlier WordPress 7.1.1 maintenance and security release and from WordPress 7.1.2, which patched a critical actively probed bug. Same habit either way: get on the new build and prove it stuck.

What this release is

Release lead Jake Spurlock describes 7.1.3 as a short security and maintenance drop on the 7.1 line. The version 7.1.3 HelpHub page repeats the seven security fixes and points you at Dashboard → Updates or the download releases page.

You do not need a CVE scavenger hunt to decide. If your dashboard still shows 7.1.2 or older on the 7.1 line, you are behind. Update, then verify.

Why the security fixes matter at home

WordPress credits several reporters for the issues fixed in this build. In plain language, the kinds of problems closed here include:

• Stored XSS on the Comments admin screen via pending comments (Trail of Bits with OpenAI)
• A denial-of-service issue in WP_Http::make_absolute_url() (Anthropic)
• A second-order SQL injection in WordPress WXR export (Anthropic)
• Authors being able to sticky posts in ways they should not (Anthropic)
• Unauthenticated disclosure of comments on private and unpublished posts (Ananda Dhakal / Patchstack)
• XSS in Imgur embeds (Zhengyu Liu, Jingcheng Yang, and Gavin Zhong)
• Forgeable parameters on the {status}_{type} hook that could collide with action names (Alex Concha, WordPress security team)

You do not need to reproduce any of that on your live site. You need the patched core. For a personal blog, “brochure site” is not a reason to skip a security release. Attackers do not care that you only post recipes.

WordPress also notes these security fixes are being backported, where needed, to older branches that still receive security updates (currently through 4.7), while reminding everyone that only the newest WordPress line is actively supported. If you are still on an ancient major, take the patched build for that branch if it ships, and plan a real upgrade path instead of another year of “it still loads.”

Update WordPress 7.1.3 now

1. Backup first if your host does not already snapshot before updates. Files plus database, something you can restore.
2. Open Dashboard → Updates.
3. Confirm WordPress core shows 7.1.3 available (or that you are already on it).
4. Click Update Now and wait for the success screen. Do not close the tab mid-flight.
5. If automatic background updates are enabled, they may already be applying. Still log in afterward and verify. Auto-update is helpful, not telepathy.
6. If the dashboard cannot reach the updater, download 7.1.3 from WordPress.org / the releases page and follow your host’s manual update path, or use WP-CLI if you already know that workflow.
7. If your host pins versions or delays core bumps, open a ticket with a screenshot of Dashboard → Updates and ask them to allow 7.1.3.

Confirm it stuck

After the update:

1. Check Dashboard → Updates (or At a Glance) for the running version. On the 7.1 line you want 7.1.3.
2. Load the front page and one editor screen. Spot-check a post and a media upload if you use those often.
3. If you maintain more than one personal site, write down which domains you updated. Forgotten staging and old campaign sites are how “I thought I patched” turns into a mess.

Do / don’t

Do

• Update the same day when WordPress ships a security release
• Verify the version after auto-update claims success
• Keep unused themes and plugins deleted, not merely deactivated
• Ask your host for help if the panel blocks the update

Don’t

• Skip the update because “it is only a personal blog”
• Wait for 7.2 to pick up these fixes
• Hunt for exploit writeups instead of clicking Update Now
• Assume an ancient major is fine forever just because backports exist

Bottom line

WordPress 7.1.3 (October 6, 2026) is a maintenance and security release with 7 security fixes and 4 bug fixes, led by Jake Spurlock (official WordPress.org news post, version docs). From Dashboard → Updates, install 7.1.3, confirm the version stuck, and move on. That is the whole job for a home or personal WordPress site.

Image: WordPress.org default OG image from the 7.1.3 maintenance and security release news post (og:image wordpress-default-ogimage.png).