Title: Version 6.1.13
Author: Lance Willett
Published: September 17, 2026

---

# Version 6.1.13

## In this article

 * [Installation/Update Information](https://wordpress.org/documentation/wordpress-version/version-6-1-13/?output_format=md#installation-update-information)
 * [Summary](https://wordpress.org/documentation/wordpress-version/version-6-1-13/?output_format=md#summary)
    - [Security updates](https://wordpress.org/documentation/wordpress-version/version-6-1-13/?output_format=md#security-updates)
 * [Change log](https://wordpress.org/documentation/wordpress-version/version-6-1-13/?output_format=md#change-log)
    - [List of files revised](https://wordpress.org/documentation/wordpress-version/version-6-1-13/?output_format=md#list-of-files-revised)
    - [List of packages revised](https://wordpress.org/documentation/wordpress-version/version-6-1-13/?output_format=md#list-of-packages-revised)

[ Back to top](https://wordpress.org/documentation/wordpress-version/version-6-1-13/?output_format=md#wp--skip-link--target)

On September 17, 2026, WordPress 6.1.13 was released to the public.

## 󠀁[Installation/Update Information](https://wordpress.org/documentation/wordpress-version/version-6-1-13/?output_format=md#installation-update-information)󠁿

To get this version, update automatically from the Dashboard > Updates menu in your
site’s admin area or visit [https://wordpress.org/download/releases/](https://wordpress.org/download/releases/).

For step-by-step instructions on installing and updating WordPress:

 * [Updating WordPress](https://wordpress.org/documentation/article/updating-wordpress/)

If you are new to WordPress, we recommend that you begin with the following:

 * [Get Started With WordPress](https://wordpress.org/documentation/article/get-started-with-wordpress/)
 * [First Steps With WordPress](https://wordpress.org/documentation/article/first-steps-with-wordpress-classic/)
   or [Upgrading WordPress Extended](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/)
 * [WordPress Courses](https://learn.wordpress.org/courses/)

## 󠀁[Summary](https://wordpress.org/documentation/wordpress-version/version-6-1-13/?output_format=md#summary)󠁿

### 󠀁[Security updates](https://wordpress.org/documentation/wordpress-version/version-6-1-13/?output_format=md#security-updates)󠁿

This release features several security fixes. Because this is a security release,**
it is recommended that you update your sites immediately.**
The security team would
like to thank the following people for [responsibly reporting vulnerabilities](https://hackerone.com/wordpress?type=team),
and allowing them to be fixed in this release:

 * An issue allowing a crafted URL to install and preview a theme from WordPress.
   org reported by Paulos Yibelo and pwn.ai
 * A stored cross-site scripting (XSS) issue in custom header images on some themes
   reported by Jeremy Felt of the WordPress Security Team
 * An information disclosure issue exposing the title of a private parent post reported
   by HDWSec
 * A multisite issue allowing a site administrator to network-activate a network-
   only plugin reported by Jesse McNeil
 * A Contributor+ arbitrary post overwrite issue reported by Anthropic
 * An authenticated path traversal issue in the REST API templates controller reported
   by Anthropic
 * An authorization issue allowing any authenticated user to reparent comments, 
   including notes, reported by viridis
 * An XML-RPC issue allowing changeset posts to bypass the custom CSS capability
   check reported by Ben Bidner of the WordPress Security Team
 * A Contributor+ disclosure of draft and pending post slugs reported by hermanhms
 * An unauthenticated stored cross-site scripting (XSS) issue via paragraph formatting,
   subject to comment approval, reported by Rafie Muhammad (Awesome Motive, Inc.)

## 󠀁[Change log](https://wordpress.org/documentation/wordpress-version/version-6-1-13/?output_format=md#change-log)󠁿

### 󠀁[List of files revised](https://wordpress.org/documentation/wordpress-version/version-6-1-13/?output_format=md#list-of-files-revised)󠁿

    ```wp-block-preformatted
    /wp-admin/includes/ajax-actions.php/wp-admin/includes/class-custom-image-header.php/wp-admin/includes/media.php/wp-admin/includes/plugin.php/wp-admin/includes/post.php/wp-admin/js/theme.js/wp-includes/block-template-utils.php/wp-includes/class-wp-xmlrpc-server.php/wp-includes/customize/class-wp-customize-header-image-setting.php/wp-includes/formatting.php/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php/wp-includes/theme.php
    ```

### 󠀁[List of packages revised](https://wordpress.org/documentation/wordpress-version/version-6-1-13/?output_format=md#list-of-packages-revised)󠁿

No package was revised.

First published

September 17, 2026

Last updated