WordPress 7.1.3 Security Update: Vulnerabilities and AI Discovery
- WordPress 7.1.3 patches seven security vulnerabilities, including stored XSS and SQL injection.
- A critical bug causing fatal errors during image uploads on certain hosts is now resolved.
- AI firm Anthropic discovered nearly half of the security flaws in this release.
- Immediate updates are recommended for all site administrators to prevent potential exploits.
The WordPress ecosystem has just received a vital security injection. With the release of version 7.1.3 on October 6, 2026, the platform has addressed seven distinct security vulnerabilities and four functional bugs. While the official documentation from WordPress urges immediate updates, the details behind this release reveal a growing trend in how software vulnerabilities are being identified in the modern era.
The role of AI in vulnerability hunting
One of the most striking aspects of the 7.1.3 release is the origin of the bug reports. AI company Anthropic is credited with discovering three of the seven security flaws. This highlights a shift in the cybersecurity landscape, where large-scale AI models are increasingly used to audit code and find edge cases that human reviewers might overlook. Anthropic's contributions include the identification of a denial-of-service (DoS) issue within the WP_Http::make_absolute_url() method and a permissions flaw that allowed users with the Author role to mark posts as sticky, a privilege typically reserved for Editors and higher-level administrators.
Beyond the AI-driven discoveries, the security community remains heavily involved. Reports also came from Trail of Bits, Patchstack, a team of independent researchers, and the internal WordPress security team. This collaborative effort underscores the necessity of a multi-layered approach to platform stability, combining automated AI analysis with specialized human expertise.
Analyzing the most dangerous security gaps
While WordPress has not provided specific CVSS scores or CVE identifiers for these flaws, the nature of the vulnerabilities suggests varying levels of risk. Perhaps the most concerning is the stored cross-site scripting (XSS) bug on the Comments administration page, reported by Thomas Chauchefoin of Trail of Bits. In this scenario, a malicious script is embedded within a pending comment. The attack remains dormant until a moderator or administrator opens the moderation queue, at which point the script executes in the administrator's browser, potentially granting the attacker high-level access to the site.
Another significant threat is the second-order SQL injection found in the WXR exporter. Unlike a standard injection, a second-order attack involves storing malicious input that does not trigger immediately. The danger manifests later, when the application reuses that stored data in a database query—in this case, during the process of exporting content as an XML file. This creates a delayed-action vulnerability that can be difficult to detect during routine testing.
Other patched vulnerabilities include:
Unauthenticated disclosure of comments on private and unpublished posts, XSS flaws related to Imgur embeds, and forgeable parameters in the _ hook that could lead to action name collisions.
Solving the critical image upload failure
Parallel to the security patches, version 7.1.3 resolves a critical functional flaw that had left some site owners unable to manage their media libraries. This bug triggered a fatal error during image uploads on hosting environments that lacked an optional DOM library. Specifically, the system was attempting to use the PHP DOM extension (ext-dom), which provides the DOMDocument and DOMXPath classes.
When this component was missing from the server, the image upload process stopped completely. While not a security breach in itself, a fatal error that halts core functionality is treated with high priority, as it directly impacts the operational capacity of business websites. This fix ensures that the platform remains stable across a wider variety of hosting configurations, reducing the dependency on optional server-side libraries for basic media management.
A pattern of rapid-fire security releases
The release of 7.1.3 is not an isolated event but part of a dense cycle of maintenance. This marks the fifth security release since early August. The frequency of these updates suggests a heightened state of vigilance or an increase in the volume of reported flaws. For instance, version 7.1.1, released on September 17, included 11 fixes, two of which were also reported by Anthropic.
Even more pressing was version 7.1.2, which patched an unauthenticated path traversal flaw (CVE-2026-87902) in page template resolution. According to reports from Cyberkendra, attackers were observed abusing that specific flaw shortly after its discovery, emphasizing the narrow window between the disclosure of a vulnerability and its exploitation in the wild.
Technical breakdown of the 7.1.3 patches
For developers and technical leads, the update involves revisions to several core files. The changes are spread across the admin directory and the core includes, targeting the REST API, the customize manager, and the query logic. The following list details the primary files modified in this release:
- /wp-admin/js/common.js
- /wp-admin/includes/export.php
- /wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php
- /wp-includes/class-wp-customize-manager.php
- /wp-includes/class-wp-customize-setting.php
- /wp-includes/class-wp-http.php
- /wp-includes/class-wp-oembed.php
- /wp-includes/class-wp-query.php
- /wp-includes/post.php
WordPress is also backporting these security fixes to older branches, extending as far back as version 4.7. However, the official stance remains that only the most recent version is actively supported, making the jump to 7.1.3 the only guaranteed path to full security.
Global business implications and regulatory outlook
For entrepreneurs and enterprises operating in the USA, UK, and global markets, this update is more than a routine technical chore; it is a matter of risk management and compliance. In the United States, while there is no single federal data protection law, various state-level regulations like the CCPA in California mandate that businesses implement reasonable security procedures to protect consumer data. A failure to patch a known critical flaw, such as a stored XSS or SQL injection, could be viewed as a lack of due diligence in the event of a data breach.
In the UK, the UK GDPR imposes strict requirements on the security of processing personal data. The prevalence of vulnerabilities that allow unauthenticated disclosure of private comments or administrator account takeover puts businesses at risk of significant regulatory fines if sensitive user information is exposed. The fact that AI firms like Anthropic are now actively scanning for these flaws means that the time between a vulnerability's existence and its discovery by potentially malicious actors is shrinking.
Global businesses should view the involvement of AI in bug hunting as a signal to automate their own update processes. Relying on manual updates in an era of AI-driven exploitation is a liability. Enabling automatic background updates is no longer just a convenience but a strategic necessity to maintain a secure digital perimeter and ensure continuity of service, especially when critical bugs can lead to fatal errors in core business functions like media uploads.
FAQ
Do I need to manually update to WordPress 7.1.3?
If you have automatic background updates enabled, the system will handle it. Otherwise, you should update immediately via Dashboard > Updates or by downloading the release from the official site.
What is the most dangerous flaw in this update?
The stored XSS on the Comments administration page is particularly risky because it targets administrators, providing a direct path for attackers to gain high-level site control.
Why is the image upload fix considered critical?
It is critical because it caused a fatal error on hosts missing the PHP DOM extension, completely preventing site owners from uploading media.
Who discovered the vulnerabilities in version 7.1.3?
The flaws were reported by Anthropic (three flaws), Trail of Bits, Patchstack, a team of independent researchers, and the WordPress security team.
Sources: Searchenginejournal, Wordpress, Cyberkendra ·
Scrivila qui: Susanna, l assistente AI di glacom, ti risponde via email con un approfondimento gratuito.
Nessuna consulenza personalizzata (finanziaria, legale o medica): solo informazione e fonti. Email usata solo per rispondere.
oppure scrivile su: WhatsApp · Telegram · SimpleX · Delta Chat · Email
