As cited
Copy frozen at (site build).
vulnerabilities
WordPress 7.1.3 Security Release
WordPress released version 7.1.3 on October 6, 2026, addressing seven security vulnerabilities including stored cross-site scripting (XSS) in comments, denial of service in URL handling, SQL injection in export functions, and unauthorized post visibility disclosures. The update also patches CVE-2026-87902, a critical flaw from the prior 7.1.2 release that allowed unauthenticated remote code execution through local file inclusion. Backports are available for versions 6.6 and earlier.
Why it matters: WordPress site administrators must update to 7.1.3 to close CVE-2026-87902 (CVSS 8.1), which enables unauthenticated remote code execution; additionally, practitioners should audit Contributor and Author role permissions, as multiple new vulnerabilities require those account levels to exploit.
- Source published
- First seen by Cybersecurity Tracker