Title: Version 7.1.3
Author: Jb Audras
Published: October 6, 2026

---

# Version 7.1.3

## In this article

 * [Installation/Update Information](https://wordpress.org/documentation/wordpress-version/version-7-1-3/?output_format=md#installation-update-information)
 * [Summary](https://wordpress.org/documentation/wordpress-version/version-7-1-3/?output_format=md#summary)
    - [Security updates](https://wordpress.org/documentation/wordpress-version/version-7-1-3/?output_format=md#security-updates)
 * [Change log](https://wordpress.org/documentation/wordpress-version/version-7-1-3/?output_format=md#change-log)
    - [List of files revised](https://wordpress.org/documentation/wordpress-version/version-7-1-3/?output_format=md#list-of-files-revised)
    - [List of packages revised](https://wordpress.org/documentation/wordpress-version/version-7-1-3/?output_format=md#list-of-packages-revised)

[ Back to top](https://wordpress.org/documentation/wordpress-version/version-7-1-3/?output_format=md#wp--skip-link--target)

On October 6, 2026, WordPress 7.1.3 was released to the public.

## 󠀁[Installation/Update Information](https://wordpress.org/documentation/wordpress-version/version-7-1-3/?output_format=md#installation-update-information)󠁿

To get this version, update automatically from the Dashboard > Updates menu in your
site’s admin area or visit [https://wordpress.org/download/releases/](https://wordpress.org/download/releases/).

For step-by-step instructions on installing and updating WordPress:

 * [Updating WordPress](https://wordpress.org/documentation/article/updating-wordpress/)

If you are new to WordPress, we recommend that you begin with the following:

 * [Get Started With WordPress](https://wordpress.org/documentation/article/get-started-with-wordpress/)
 * [First Steps With WordPress](https://wordpress.org/documentation/article/first-steps-with-wordpress-classic/)
   or [Upgrading WordPress Extended](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/)
 * [WordPress Courses](https://learn.wordpress.org/courses/)

## 󠀁[Summary](https://wordpress.org/documentation/wordpress-version/version-7-1-3/?output_format=md#summary)󠁿

### 󠀁[Security updates](https://wordpress.org/documentation/wordpress-version/version-7-1-3/?output_format=md#security-updates)󠁿

This release features one security fix. Because this is a security release, **it
is recommended that you update your sites immediately.**
The security team would
like to thank the following people for [responsibly reporting vulnerabilities](https://hackerone.com/wordpress?type=team),
and allowing them to be fixed in this release:

 * A stored XSS on the Comments administration page, exploitable via pending comments,
   reported by [Thomas Chauchefoin at Trail of Bits](https://trailofbits.com/)
 * A DoS issue in the `WP_Http::make_absolute_url()` method, reported by Anthropic
 * A second-Order SQL injection in WordPress WXR export, reported by Anthropic
 * A weakness allowing Author role users to sticky posts, reported by Anthropic
 * Unauthenticated disclosure of comments on private & unpublished posts, reported
   by [Ananda Dhakal from Patchstack](https://patchstack.com/)
 * Imgur embeds are vulnerable to XSS, reported by [Zhengyu Liu](https://jackfromeast.github.io/),
   [Jingcheng Yang](https://jesse-yang.com/), and [Gavin Zhong](https://gvzhong.github.io/)
 * Forgeable parameters passed to the `{status}_{type}` hook can lead to action 
   name collision, reported by Alex Concha of the WordPress security team

As a courtesy, these fixes are also available in older affected branches of WordPress.
As a reminder, **only the most recent version of WordPress is actively supported.**

## 󠀁[Change log](https://wordpress.org/documentation/wordpress-version/version-7-1-3/?output_format=md#change-log)󠁿

### 󠀁[List of files revised](https://wordpress.org/documentation/wordpress-version/version-7-1-3/?output_format=md#list-of-files-revised)󠁿

    ```wp-block-preformatted
    /wp-admin/js/common.js/wp-admin/includes/export.php/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php/wp-includes/class-wp-customize-manager.php/wp-includes/class-wp-customize-setting.php/wp-includes/class-wp-http.php/wp-includes/class-wp-oembed.php/wp-includes/class-wp-query.php/wp-includes/post.php
    ```

### 󠀁[List of packages revised](https://wordpress.org/documentation/wordpress-version/version-7-1-3/?output_format=md#list-of-packages-revised)󠁿

No package was revised.

First published

October 6, 2026

Last updated