WordPress 7.1.3 Patches Seven Vulnerabilities

Key Takeaways

• WordPress 7.1.3 is a security release, published 6 October 2026, fixing seven vulnerabilities plus four bugs. WordPress recommends updating immediately.
• The seven include a stored XSS, a second-order SQL injection, an unauthenticated disclosure of comments and a denial-of-service issue.
• No severity ratings or CVSS scores were published, and no information was given on whether any of these are being exploited. That absence is itself a reason to patch rather than wait.
• A separate bug rated critical — image uploads failing with a fatal error on hosts missing PHP's DOM extension — is also fixed, though a core committer indicated it is probably rare.

What Happened

On 6 October 2026, Search Engine Journal reported that WordPress had shipped version 7.1.3, a security release addressing seven vulnerabilities alongside four bug fixes.

The seven vulnerabilities named are:

• Stored XSS
• A denial-of-service (DoS) issue
• Second-order SQL injection
• A weakness allowing Author role users to sticky posts
• Unauthenticated disclosure of comments
• Imgur embeds vulnerable to XSS
• Forgeable parameters that can lead to action name collision

The official announcement did not list severity ratings or CVSS scores, did not describe the vulnerabilities in detail, and said nothing about whether any are being exploited in the wild. WordPress's own guidance was simply to update immediately. The fixes are also being backported to older branches eligible for security support — currently reaching as far back as WordPress 4.7 — with those backports still in progress.

Of the four bug fixes, three are minor: two address oEmbed endpoints returning 404s, and one fixes a site icon in the admin toolbar expanding to an enormous size. The fourth is the one rated critical, and it is worth understanding precisely:

• On hosts missing PHP's DOM extension (ext-dom, which provides DOMDocument and DOMXPath), image uploads could fail with a fatal error, leaving site owners unable to upload media.
• WordPress strongly recommends that extension but does not require it. WordPress 7.0 introduced code that used DOMDocument without first checking whether it existed.
• A core committer noted the code had been live for 134 days before the first report, which implies nearly all hosts already provide the extension and the problem is not widespread.

Industry Impact & Ranking Volatility

There is no ranking mechanic here, but there is a real SEO consequence, and it is the one that catches sites out. A compromised WordPress install is most often monetised through injected content — spam links, cloaked pages, redirects shown only to Googlebot. By the time that surfaces in Search Console as a manual action or a security issue, the damage is done and removing it is slower than preventing it.

A stored XSS and an unauthenticated disclosure of comments are exactly the kind of flaws that become automated scans within days of a release, because the release itself tells attackers what to look for. The absence of severity scores does not make the risk smaller; it just means nobody outside the security team can judge it, which argues for treating all seven as urgent rather than triaging them.

The image upload bug deserves calmer handling. It is rated critical on the ticket, but it breaks a feature rather than exposing a site, and it only affects hosts without a PHP extension that almost all of them provide. If your media library has been working, you are almost certainly not affected.

SearchPrex Action Checklist

1. Update to 7.1.3 today on every site you run. This is a security release with no severity information published, which is the case for patching quickly rather than scheduling it.
2. Check older installs too. Fixes are being backported through WordPress 4.7, but the backports are still rolling out. A site on an old branch is not automatically covered yet.
3. Take a backup before updating, especially on a store or a site with many plugins. That is routine, and it is what makes a bad update a ten-minute problem instead of a day.
4. Verify after updating — load the front end, submit a form, and upload an image to the media library. The image upload check is directly relevant to one of the fixes.
5. Turn on automatic updates for minor releases if you have not. Security releases are exactly the category where automatic updates are worth the loss of control. Our technical SEO checklist covers the rest of the site health review.

Quick answers

What does WordPress 7.1.3 fix?

Seven security vulnerabilities — including a stored XSS, a second-order SQL injection, an unauthenticated disclosure of comments and a denial-of-service issue — plus four bug fixes, one of which is a critical bug that caused image uploads to fail on some hosts.

How urgent is the WordPress 7.1.3 update?

WordPress recommends updating immediately. No severity ratings or CVSS scores were published and no information was given about exploitation, so there is no basis for deciding any of the seven can safely wait.

Does the critical flaw mean my site was hacked?

No. The bug rated critical is an image upload failure on hosts missing PHP's DOM extension, not a security breach. A core committer indicated it is likely rare, as the code had been live 134 days before the first report.

📌 Original Source Reference: Read the report at Search Engine Journal.

Sources

• WordPress 7.1.3 Fixes 7 Vulnerabilities And 1 Critical Flaw — Search Engine Journal, 6 October 2026.

Last verified: 8 October 2026.

---

About the Author

Mubashar Sharif is a Verified SEO Expert and Senior Analyst at SearchPrex. He tracks daily SERP fluctuations, Google core algorithm shifts, and generative AI search architecture. Connect with Mubashar on LinkedIn.