{"id":1502,"date":"2026-10-23T11:17:06","date_gmt":"2026-10-23T11:17:06","guid":{"rendered":"https:\/\/www.ahosting.net\/blog\/?p=1502"},"modified":"2026-10-23T11:17:07","modified_gmt":"2026-10-23T11:17:07","slug":"wordpress-7-1-3-security-release","status":"publish","type":"post","link":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/","title":{"rendered":"WordPress 7.1.3 Security Release: What Changed and How to Confirm Your Site Has It"},"content":{"rendered":"\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Do I need the WordPress 7.1.3 security release on my site in 2026?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, yes if your site reports 7.1.2 or any earlier 7.1 version. WordPress.org recommends updating immediately because it is a security release. Patchstack says the update is not a drop-everything emergency, so schedule it today, not next month.\"}}, {\"@type\": \"Question\", \"name\": \"When was the WordPress 7.1.3 security release published and which fixes does it carry?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, WordPress.org published it on 6 October 2026 with seven security fixes and four bug fixes. The fixes cover a Comments screen XSS, a denial of service, an export SQL injection, sticky posts for Authors, comment disclosure, Imgur embeds and a hook name collision.\"}}, {\"@type\": \"Question\", \"name\": \"Does the WordPress 7.1.3 security release install itself on every WordPress site in 2026?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"However, not on every site. WordPress installs minor releases by default, and a fresh 7.1.2 lab site replaced itself with 7.1.3 within minutes. A constant in wp-config.php, a plugin filter, a locked file system, a Git folder or a stalled WP-Cron can stop it.\"}}, {\"@type\": \"Question\", \"name\": \"What changed between WordPress 7.1.2 vs 7.1.3 in the WordPress 7.1.3 security release?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"In practice, 15 files differ between the two official archives, and 9 of them are PHP. The changes sit in the HTTP class, the query class, the REST posts controller, the oEmbed class, the export tool, the post status code and the image helper.\"}}, {\"@type\": \"Question\", \"name\": \"How can I confirm the WordPress 7.1.3 security release reached my AHosting WordPress site?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, open Tools, then Site Health, then Info, then WordPress, and read the version. You can also open wp-includes\/version.php in cPanel File Manager and read the wp_version line. Anything below 7.1.3 means the update did not arrive.\"}}, {\"@type\": \"Question\", \"name\": \"Shared hosting vs VPS: who installs the WordPress 7.1.3 security release for me?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Typically, WordPress core lives inside your own site and updates itself on both. On shared hosting your provider handles the server packages. On a VPS you handle the packages and the application, so you must also verify the core version yourself.\"}}, {\"@type\": \"Question\", \"name\": \"Is WordPress 7.1.2 vulnerable until the WordPress 7.1.3 security release is installed in 2026?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, yes, because 7.1.2 lacks the seven security fixes, and my lab showed it leaking private post comments and letting an Author make posts sticky. However, WordPress published no CVE IDs and the coverage I opened reports no confirmed exploitation, so update promptly without panic.\"}}, {\"@type\": \"Question\", \"name\": \"Which Imgur embeds need attention after the update, and does clearing the cache matter?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Notably, the fix removes Imgur from the trusted embed list but does not remove embeds already stored. Patchstack advises clearing your cache after updating. Review posts that contain Imgur links, especially ones written by Contributor accounts.\"}}, {\"@type\": \"Question\", \"name\": \"Does AHosting CageFS protect a site from a WordPress core flaw like the comment disclosure?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"In practice, no, not from a flaw inside the site itself. CageFS keeps one account from reading another account, but a leaked comment feed is the content of the site itself, served by its own WordPress. Updating WordPress is what closes that kind of flaw.\"}}, {\"@type\": \"Question\", \"name\": \"How can AHosting help me when the WordPress 7.1.3 security release does not appear under Updates?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, open a ticket and include the WordPress version from Site Health and the PHP version shown under the Server tab. We will look at it with you. Meanwhile, check wp-config.php for a WP_AUTO_UPDATE_CORE or AUTOMATIC_UPDATER_DISABLED line.\"}}]}<\/script>\n\n\n<div class=\"wp-block-aioseo-table-of-contents\"><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-wordpress-7-1-3-security-release-what-changed-and-who-can-reach-it\">WordPress 7.1.3 Security Release: What Changed and Who Can Reach It<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-wordpress-7-1-3-security-release-facts-from-wordpress-org-and-patchstack\">WordPress 7.1.3 Security Release Facts From WordPress.org and Patchstack<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-does-the-wordpress-7-1-3-security-release-apply-to-your-site\">Does the WordPress 7.1.3 Security Release Apply to Your Site?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-did-the-wordpress-7-1-3-security-release-reach-your-site-automatically\">Did the WordPress 7.1.3 Security Release Reach Your Site Automatically?<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-what-blocks-automatic-updates-in-wordpress-core\">What Blocks Automatic Updates in WordPress Core<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-lab-results-wordpress-7-1-2-against-7-1-3\">Lab Results: WordPress 7.1.2 Against 7.1.3<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-the-comment-disclosure-fix-in-the-wordpress-7-1-3-security-release\">The Comment Disclosure Fix in the WordPress 7.1.3 Security Release<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-the-sticky-post-fix-and-who-holds-author-roles\">The Sticky Post Fix and Who Holds Author Roles<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-the-make_absolute_url-loop-that-never-ended\">The make_absolute_url() Loop That Never Ended<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-the-image-upload-bug-in-the-wordpress-7-1-3-security-release\">The Image Upload Bug in the WordPress 7.1.3 Security Release<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-imgur-embeds-after-the-wordpress-7-1-3-security-release\">Imgur Embeds After the WordPress 7.1.3 Security Release<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-what-i-could-not-tie-to-code\">What I Could Not Tie to Code<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-who-applies-the-wordpress-7-1-3-security-release-shared-hosting-vps-or-you\">Who Applies the WordPress 7.1.3 Security Release: Shared Hosting, VPS or You?<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-shared-hosting-the-host-patches-packages-you-verify-wordpress\">Shared Hosting: The Host Patches Packages, You Verify WordPress<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-vps-and-woocommerce-you-verify-both-layers\">VPS and WooCommerce: You Verify Both Layers<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-wordpress-7-1-3-security-release\">Frequently Asked Questions: WordPress 7.1.3 Security Release<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#faq-do-i-need-wordpress-7-1-3\">Do I need the WordPress 7.1.3 security release on my site in 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-wordpress-7-1-3-release-date-and-fixes\">When was the WordPress 7.1.3 security release published and which fixes does it carry?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-wordpress-7-1-3-install-itself\">Does the WordPress 7.1.3 security release install itself on every WordPress site in 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-wordpress-7-1-2-vs-7-1-3-files\">What changed between WordPress 7.1.2 vs 7.1.3 in the WordPress 7.1.3 security release?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-confirm-wordpress-7-1-3-ahosting\">How can I confirm the WordPress 7.1.3 security release reached my AHosting WordPress site?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-shared-hosting-vs-vps-wordpress-7-1-3\">Shared hosting vs VPS: who installs the WordPress 7.1.3 security release for me?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-wordpress-7-1-2-vulnerable-before-7-1-3\">Is WordPress 7.1.2 vulnerable until the WordPress 7.1.3 security release is installed in 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-imgur-embeds-after-wordpress-7-1-3\">Which Imgur embeds need attention after the update, and does clearing the cache matter?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-ahosting-cagefs-wordpress-core-flaw\">Does AHosting CageFS protect a site from a WordPress core flaw like the comment disclosure?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-ahosting-help-wordpress-7-1-3-missing\">How can AHosting help me when the WordPress 7.1.3 security release does not appear under Updates?<\/a><\/li><\/ul><\/li><\/ul><\/div>\n\n\n<div class=\"ah-tldr\">\n  <span class=\"ah-tldr-badge\">TL;DR<\/span>\n  <p>The WordPress 7.1.3 security release shipped on 6 October 2026 with seven security fixes and four bug fixes. Read your version under Tools, Site Health, Info, WordPress; 7.1.2 or any earlier 7.1 release needs the update. Minor releases install themselves by default, but a handful of switches stop that. In my lab, 7.1.2 handed an anonymous visitor the comments on a private post and a draft post and let an Author account make posts sticky; 7.1.3 refused both. WordPress published no CVE IDs, and none of the coverage I opened reports exploitation.<\/p>\n<\/div>\n\n\n\n<h2 id=\"aioseo-wordpress-7-1-3-security-release-what-changed-and-who-can-reach-it\" class=\"wp-block-heading\">WordPress 7.1.3 Security Release: What Changed and Who Can Reach It<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The WordPress 7.1.3 security release shipped on 6 October 2026 with seven security fixes and four bug fixes. <a href=\"https:\/\/wordpress.org\/news\/2026\/10\/wordpress-7-1-3-maintenance-and-security-release\/\" target=\"_blank\" rel=\"noopener\">WordPress.org<\/a> recommends updating immediately. This guide reads the release the way a host does. It checks whether the update reached your site, and it compares the real code of 7.1.2 and 7.1.3 file by file. Every fact below is dated 23 October 2026.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Seven fixes sounds like a lot of change, but the change is small. I downloaded both official archives and compared them: 15 files differ, and 9 of those are PHP. The rest are one admin script with its minified copy, four admin bar style sheets and the version number.<\/p>\n\n\n\n<h3 id=\"aioseo-wordpress-7-1-3-security-release-facts-from-wordpress-org-and-patchstack\" class=\"wp-block-heading\">WordPress 7.1.3 Security Release Facts From WordPress.org and Patchstack<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>WordPress.org lists the seven fixes and credits each reporter in its <a href=\"https:\/\/wordpress.org\/documentation\/wordpress-version\/version-7-1-3\/\" target=\"_blank\" rel=\"noopener\">version 7.1.3 notes<\/a>.<\/li>\n\n\n\n<li>The same notes say older branches get the fixes as a courtesy, and only the newest version is actively supported.<\/li>\n\n\n\n<li>Patchstack, which wrote the most detailed <a href=\"https:\/\/patchstack.com\/articles\/wordpress-7-1-3-security-release\/\" target=\"_blank\" rel=\"noopener\">analysis of the seven fixes<\/a>, says only two of them can start from a visitor with no login.<\/li>\n\n\n\n<li>WordPress assigned no CVE IDs and published no severity scores for these fixes, and <a href=\"https:\/\/securityonline.info\/wordpress-7-1-3-security-update\/\" target=\"_blank\" rel=\"noopener\">SecurityOnline<\/a> reports no confirmed exploitation and no public proof of concept.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-table ah-ladder\"><table><thead><tr><th>Fix as WordPress lists it<\/th><th>Who can reach it (Patchstack)<\/th><th>Changed file in 7.1.3<\/th><th>What the diff shows<\/th><\/tr><\/thead><tbody><tr><td>Stored XSS on the Comments admin screen<\/td><td>A visitor posts a pending comment; a moderator must click its link<\/td><td>Not found in the diff<\/td><td>I could not tie it to a changed line<\/td><\/tr><tr><td>Denial of service in WP_Http::make_absolute_url()<\/td><td>Contributor or higher<\/td><td>class-wp-http.php<\/td><td>A loop now stops when a pass removes nothing<\/td><\/tr><tr><td>Second-order SQL injection in the WXR export<\/td><td>An administrator running an export, plus a bad stored thumbnail value<\/td><td>export.php<\/td><td>IDs are cast to integers with absint() in three places<\/td><\/tr><tr><td>Author role can make posts sticky<\/td><td>Author or higher<\/td><td>class-wp-rest-posts-controller.php<\/td><td>An AND in the permission check became an OR<\/td><\/tr><tr><td>Comments on private and unpublished posts disclosed<\/td><td>Anyone, no login<\/td><td>class-wp-query.php<\/td><td>The comment feed query moves below the post status check<\/td><\/tr><tr><td>Imgur embeds vulnerable to XSS<\/td><td>Contributor or higher, plus a viewer<\/td><td>class-wp-oembed.php<\/td><td>Imgur is dropped from the trusted provider list<\/td><\/tr><tr><td>Hook name collision in the status and type hooks<\/td><td>Needs a plugin that passes raw values<\/td><td>post.php<\/td><td>The hooks fire only for registered statuses and types<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">AHosting WordPress 7.1.3 Fix-to-Code Map. Reach: Patchstack. Diff: my comparison of the official archives.<\/figcaption><\/figure>\n\n\n\n<h2 id=\"aioseo-does-the-wordpress-7-1-3-security-release-apply-to-your-site\" class=\"wp-block-heading\">Does the WordPress 7.1.3 Security Release Apply to Your Site?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your site reports 7.1.2 or any earlier 7.1 version, it needs 7.1.3. Patchstack says the Comments screen XSS affects 7.1.0 through 7.1.2, and <a href=\"https:\/\/securityonline.info\/wordpress-7-1-3-security-update\/\" target=\"_blank\" rel=\"noopener\">SecurityOnline<\/a> says every version before 7.1.3 is affected. The comment disclosure fix exists only from 7.1.3 on, as the lab results below show.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Older branches depend on backports. WordPress.org said they were still in progress when it published, and Patchstack reported fixes available through at least 6.6 on 6 October, with branches 4.7 through 6.5 not yet patched at that point. Check Dashboard, then Updates, for a patch release on your own branch.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Read your version in one of three places. Tools, then Site Health, then Info, then WordPress shows it. In cPanel File Manager, open wp-includes\/version.php and read the wp_version line. With WP-CLI, the command wp core version prints it. The checker below turns that number into a next step.<\/p>\n\n\n\n<style>\n.ahwpu-tool{border:1px solid #2563eb;border-radius:12px;padding:20px;background:#eff6ff;margin:24px 0}\n.ahwpu-tool h3{margin:0 0 12px;font-size:1.25rem}\n.ahwpu-tool label{display:block;font-weight:600;margin:12px 0 4px}\n.ahwpu-tool select{width:100%;max-width:420px;padding:8px;border:1px solid #94a3b8;border-radius:8px;font-size:1rem;box-sizing:border-box}\n.ahwpu-tool .ahwpu-out{margin-top:16px;padding:12px 16px;background:#fff;border-left:4px solid #2563eb;border-radius:6px}\n.ahwpu-tool button.ahwpu-btn{margin-top:16px;padding:10px 20px;border:0;border-radius:8px;background:#2563eb;color:#fff;font-size:1rem;cursor:pointer}\na.ahwpu-cta.wp-element-button{display:inline-block;margin-top:12px;color:#fff !important;background:#2563eb !important;text-decoration:none !important;padding:10px 20px;border-radius:8px}\n<\/style>\n<div class=\"ahwpu-tool\">\n  <h3>WordPress 7.1.3 Security Release Update Check<\/h3>\n  <label for=\"ahwpu-version\">Which WordPress version does your site report?<\/label>\n  <select id=\"ahwpu-version\">\n    <option value=\"v713\">7.1.3 or newer<\/option>\n    <option value=\"v71old\">7.1.0, 7.1.1 or 7.1.2<\/option>\n    <option value=\"vold\">Older than 7.1<\/option>\n    <option value=\"vunk\">I do not know<\/option>\n  <\/select>\n  <label for=\"ahwpu-how\">How do core updates reach your site?<\/label>\n  <select id=\"ahwpu-how\">\n    <option value=\"auto\">Automatic updates are left on<\/option>\n    <option value=\"frozen\">I switched them off or deploy from a Git repository<\/option>\n  <\/select>\n  <button type=\"button\" class=\"ahwpu-btn\" data-ahwpu=\"check\">Check my site<\/button>\n  <div class=\"ahwpu-out\" id=\"ahwpu-out\" aria-live=\"polite\">Choose your version and how updates run, then select the button.<\/div>\n  <a class=\"ahwpu-cta wp-element-button\" href=\"https:\/\/www.ahosting.net\/wordpress-hosting.html\">See WordPress hosting plans<\/a>\n<\/div>\n<script>\n(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var root = document.querySelector('.ahwpu-tool');\n    if (!root) { return; }\n    var out = document.getElementById('ahwpu-out');\n    if (!out) { return; }\n    var verEl = document.getElementById('ahwpu-version');\n    if (!verEl) { return; }\n    var howEl = document.getElementById('ahwpu-how');\n    if (!howEl) { return; }\n    var head = {\n      'v713': 'Your site reports 7.1.3 or newer.',\n      'v71old': 'Your site is on a 7.1 release below 7.1.3.',\n      'vold': 'Your site is on a branch older than 7.1.',\n      'vunk': 'You need the version number first.'\n    };\n    var body = {\n      'v713': 'The seven security fixes are in your files. Confirm the number once under Tools, Site Health, Info, WordPress, then clear your page cache so stored embeds and cached feeds are rebuilt.',\n      'v71old': 'Update to 7.1.3 now under Dashboard, Updates. Patchstack says the Comments screen XSS affects 7.1.0 through 7.1.2, and the comment disclosure fix is only in 7.1.3.',\n      'vold': 'WordPress.org says it backports the fixes to older branches as a courtesy and that only the newest version is actively supported. Check Dashboard, Updates for a patch release on your branch, and plan the move to 7.1.3 after testing on staging.',\n      'vunk': 'Open Tools, Site Health, Info, WordPress and read the first line. In cPanel File Manager you can also open wp-includes\/version.php and read the wp_version line.'\n    };\n    var how = {\n      'auto': 'Automatic updates are on, so a release should install itself during a WP-Cron run. If the version above is still old, look for a blocker in wp-config.php or a plugin.',\n      'frozen': 'Updates are frozen on your site, so nothing will install by itself. Apply the update by hand, or deploy the new files through your repository, and test the Comments screen and a post save afterward.'\n    };\n    root.addEventListener('click', function(ev){\n      var t = ev.target;\n      if (!t) { return; }\n      var action = t.getAttribute('data-ahwpu');\n      if (action !== 'check') { return; }\n      var v = verEl.value;\n      var h = howEl.value;\n      out.innerHTML = '<p><strong>' + head[v] + '<\/strong><\/p><p>' + body[v] + '<\/p><p>' + how[h] + '<\/p><p>Take a full backup before you change anything.<\/p>';\n    });\n  });\n})();\n<\/script>\n\n\n\n<h2 id=\"aioseo-did-the-wordpress-7-1-3-security-release-reach-your-site-automatically\" class=\"wp-block-heading\">Did the WordPress 7.1.3 Security Release Reach Your Site Automatically?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Possibly, because WordPress installs minor releases by default. The <a href=\"https:\/\/developer.wordpress.org\/advanced-administration\/upgrade\/upgrading\/#configuring-automatic-background-updates\" target=\"_blank\" rel=\"noopener\">WordPress upgrade documentation<\/a> says existing installations receive minor core updates, such as maintenance and security releases, unless you change that.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I tested it. On 23 October 2026 I built a fresh WordPress 7.1.2 site on my workstation with default settings. Within a few minutes it had replaced its own core files and reported 7.1.3. That was one machine with outbound network access, not an AHosting server, so treat it as proof that the mechanism works, not as a promise about any particular site.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A second 7.1.2 site, built with automatic core updates switched off, stayed on 7.1.2 for the whole test. That is the state of any site where something blocks the updater, and it is the state in which this release never arrives.<\/p>\n\n\n\n<h3 id=\"aioseo-what-blocks-automatic-updates-in-wordpress-core\" class=\"wp-block-heading\">What Blocks Automatic Updates in WordPress Core<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">I read the updater in the WordPress 7.1.3 source. The blockers are specific, and most of them are choices someone made once and forgot.<\/p>\n\n\n\n<figure class=\"wp-block-table ah-ladder\"><table><thead><tr><th>Blocker<\/th><th>Where WordPress checks it<\/th><th>How a site ends up with it<\/th><\/tr><\/thead><tbody><tr><td>WP_AUTO_UPDATE_CORE set to false in wp-config.php<\/td><td>Documented core setting<\/td><td>Someone froze core after a bad update<\/td><\/tr><tr><td>AUTOMATIC_UPDATER_DISABLED set to true<\/td><td>class-wp-automatic-updater.php, is_disabled()<\/td><td>A hardening guide or a staging copy<\/td><\/tr><tr><td>The automatic_updater_disabled filter returns true<\/td><td>The same function, one line later<\/td><td>A plugin or a must-use plugin<\/td><\/tr><tr><td>DISALLOW_FILE_MODS set to true<\/td><td>wp_is_file_mod_allowed() in load.php<\/td><td>A locked-down production setup<\/td><\/tr><tr><td>A .git, .svn, .hg or .bzr folder in the site folder or above it<\/td><td>class-wp-automatic-updater.php, is_vcs_checkout()<\/td><td>A site deployed from a repository<\/td><\/tr><tr><td>WP-Cron never runs<\/td><td>wp-includes\/update.php starts the update only during a cron run<\/td><td>DISABLE_WP_CRON with no system cron behind it<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">Update blockers read from the WordPress 7.1.3 source, 23 October 2026.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Plugin and theme updates follow their own switches, which our post on <a href=\"https:\/\/www.ahosting.net\/blog\/your-site-may-have-problems-auto-updating-plugins-and-themes\/\">auto-updating plugins and themes<\/a> walks through. If any row above matches your site, press Update Now under Dashboard, then Updates, and do not wait for the updater.<\/p>\n\n\n\n<h2 id=\"aioseo-lab-results-wordpress-7-1-2-against-7-1-3\" class=\"wp-block-heading\">Lab Results: WordPress 7.1.2 Against 7.1.3<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Reading a diff tells you what changed. Running both versions tells you what it meant. I installed WordPress 7.1.2 and 7.1.3 side by side with the SQLite integration plugin from WordPress.org, then repeated the same requests against each.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Setup: one workstation, PHP 8.5.10, one private post, one draft post and one public post, each with an approved comment, plus an Author account. This is not an AHosting server, and I did not test the SQL injection, the Comments screen XSS or the hook collision.<\/p>\n\n\n\n<figure class=\"wp-block-table ah-ladder\"><table><thead><tr><th>Request<\/th><th>WordPress 7.1.2<\/th><th>WordPress 7.1.3<\/th><\/tr><\/thead><tbody><tr><td>Anonymous request for the comment feed of the private post<\/td><td>Returned the comment<\/td><td>Empty feed<\/td><\/tr><tr><td>Anonymous request for the comment feed of the draft post<\/td><td>Returned the comment<\/td><td>Empty feed<\/td><\/tr><tr><td>Anonymous request for the site-wide comment feed<\/td><td>Public post comment only<\/td><td>Public post comment only<\/td><\/tr><tr><td>Author creates a published post with sticky set to true through the REST API<\/td><td>201 Created, post made sticky<\/td><td>403 rest_cannot_assign_sticky<\/td><\/tr><tr><td>Author marks an existing post of their own sticky<\/td><td>200 OK, post made sticky<\/td><td>403 rest_cannot_assign_sticky<\/td><\/tr><tr><td>make_absolute_url() with a crafted relative path<\/td><td>Ran until PHP time limit hit at 3 seconds<\/td><td>Returned at once<\/td><\/tr><tr><td>oEmbed provider lookup for an imgur.com link<\/td><td>Mapped to the Imgur endpoint<\/td><td>No provider found<\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">AHosting WordPress 7.1.2 vs 7.1.3 Lab Results, run 23 October 2026 on one workstation.<\/figcaption><\/figure>\n\n\n\n<h2 id=\"aioseo-the-comment-disclosure-fix-in-the-wordpress-7-1-3-security-release\" class=\"wp-block-heading\">The Comment Disclosure Fix in the WordPress 7.1.3 Security Release<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is the fix that needs no login. In 7.1.2, an anonymous request for the comment feed of a single post returned the comments of a private post and of a draft post. WordPress had already built the comment list before it decided the visitor was not allowed to see the post.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The cause is an ordering problem in class-wp-query.php. In 7.1.2 the comment feed query runs first, and the post status check that empties the post list runs afterward, which is too late for the comments already loaded. The 7.1.3 diff moves the whole comment block below the status check, so a hidden post now produces an empty feed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two limits keep this in proportion. The comment must already be approved, which happens, for example, when it was approved before the post went private or when a logged-in editor replied. The visitor also needs the post ID, and those are sequential numbers. Neither limit makes the bug harmless on a site that keeps member-only or unreleased content.<\/p>\n\n\n\n<h2 id=\"aioseo-the-sticky-post-fix-and-who-holds-author-roles\" class=\"wp-block-heading\">The Sticky Post Fix and Who Holds Author Roles<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The sticky bug is a one-operator logic error, and my lab reproduced it exactly. The REST posts controller refused the request only if the user lacked both the edit-others and the publish capability. An Author has the publish capability, so the check passed. 7.1.3 changed the AND to an OR.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The impact is modest: an Author could pin their own post to the top of the blog index. The lesson is wider. Patchstack warns that several of the seven fixes concern what Contributor and Author roles can reach, and recommends auditing who holds them. Our guide to <a href=\"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/\">open registration and the default role<\/a> shows where a site quietly hands those roles out.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The update path changed too. 7.1.3 checks the sticky permission only when a request would change the sticky state, so an Author editing a post that is already sticky is not blocked.<\/p>\n\n\n\n<h2 id=\"aioseo-the-make_absolute_url-loop-that-never-ended\" class=\"wp-block-heading\">The make_absolute_url() Loop That Never Ended<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress resolves relative redirect addresses with WP_Http::make_absolute_url(). It strips every segment-then-dot-dot pair with a regular expression, in a loop that runs while the path still contains the dot-dot sequence. In 7.1.2, if the expression matches nothing, the sequence never leaves and the loop never ends.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I tested a path of that shape against the real 7.1.2 function. It ran until PHP stopped it at my 3 second limit. The 7.1.3 version counts the replacements in each pass and exits the loop when the count is zero, and it answered at once. I am not printing the exact input.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The caller matters. In class-wp-http.php, redirect handling reads the Location header of a response and passes it to this function, so a site fetching a remote address that redirects can reach it. Patchstack says the attack needs a Contributor account or higher. A request stuck in that loop holds one PHP process until the time limit ends it, which is why the fix belongs in the update, not in a server setting.<\/p>\n\n\n\n<h2 id=\"aioseo-the-image-upload-bug-in-the-wordpress-7-1-3-security-release\" class=\"wp-block-heading\">The Image Upload Bug in the WordPress 7.1.3 Security Release<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Four bug fixes ship beside the seven security fixes, and <a href=\"https:\/\/www.searchenginejournal.com\/wordpress-7-1-3-fixes-7-vulnerabilities-and-1-critical-flaw\/592109\/\" target=\"_blank\" rel=\"noopener\">Search Engine Journal<\/a> calls one of them critical, citing the WordPress ticket rating. Image uploads could fail with a fatal error on a server whose PHP lacks the DOM extension. It is not a security fix, but it breaks the Media Library.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The code explains it. The image helper wp_get_image_alttext() builds a DOMDocument to read the alternative text stored in a photo. In 7.1.2 it never checked that the class exists. The 7.1.3 diff adds that check at the top and returns an empty string instead. The function reaches the DOM code only when the file contains XMP metadata.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I did not reproduce the crash. The PHP on my machine has the extension built in, and the switch I tried to hide the class had no effect. Site Health lists the dom extension under PHP extensions as optional, so your own Info, Server tab shows whether your server has it. For the PHP side of the same server, see our guide to the <a href=\"https:\/\/www.ahosting.net\/blog\/best-php-version-for-wordpress-cpanel\/\">best PHP version for WordPress in cPanel<\/a>.<\/p>\n\n\n\n<h2 id=\"aioseo-imgur-embeds-after-the-wordpress-7-1-3-security-release\" class=\"wp-block-heading\">Imgur Embeds After the WordPress 7.1.3 Security Release<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Imgur fix removes the provider rather than patching it. In 7.1.2, WordPress mapped imgur.com links to the Imgur endpoint. In 7.1.3 my lookup found no provider for an imgur.com link. The class-wp-oembed.php docblock now lists Imgur, and two Someecards domains, among the providers no longer supported as of 7.1.3.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The oEmbed format works by asking a provider endpoint for HTML to place in your page, as the <a href=\"https:\/\/oembed.com\/\" target=\"_blank\" rel=\"noopener\">oEmbed specification<\/a> describes. Patchstack explains that Imgur sat on the trusted list, so its output skipped the sandboxing filter.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Existing embeds are the catch. WordPress stores a fetched embed in post meta under keys that begin with _oembed_, and Patchstack warns the fix does not remove cached content already stored. Clear your page and object caches after updating, and search your posts for imgur.com links written by Contributor accounts.<\/p>\n\n\n\n<h2 id=\"aioseo-what-i-could-not-tie-to-code\" class=\"wp-block-heading\">What I Could Not Tie to Code<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A guide that claims to have verified everything is lying. Here is what I could not verify. The stored XSS on the Comments admin screen, reported by Trail of Bits, has no changed line in the comments list table that I could find. The only admin script that changed is the help tab handler in common.js, and I will not call that the fix.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress.org also lists two Customizer files among the revised files in its 7.1.3 notes. In the two archives I downloaded, both files are byte-identical. I cannot explain that difference, and I would rather say so than guess.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What I can say comes from Patchstack: the attack starts with a pending comment and needs a moderator to click a link in it. Until you update, moderators should not click links inside pending comments. The export SQL injection needs an administrator to run an export and a bad thumbnail value already stored, and the hook collision needs a plugin that passes raw values into post creation.<\/p>\n\n\n\n<h2 id=\"aioseo-who-applies-the-wordpress-7-1-3-security-release-shared-hosting-vps-or-you\" class=\"wp-block-heading\">Who Applies the WordPress 7.1.3 Security Release: Shared Hosting, VPS or You?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress core is your application, so the answer is mostly you on every kind of hosting. The host updates the server and the PHP packages. WordPress updates itself from inside your account, unless one of the blockers above stops it. Our <a href=\"https:\/\/www.ahosting.net\/blog\/php-security-update-8-5-12-8-4-27-8-3-36-8-2-35\/\">PHP security update guide<\/a> covers the server half of that split.<\/p>\n\n\n\n<h3 id=\"aioseo-shared-hosting-the-host-patches-packages-you-verify-wordpress\" class=\"wp-block-heading\">Shared Hosting: The Host Patches Packages, You Verify WordPress<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">On shared web hosting, your provider keeps the server software current, and you read the WordPress version. First-hand, the AHosting customer server we inspected runs CloudLinux 9 with CageFS and LVE, and its LiteSpeed PHP processes run as each site&#8217;s own cPanel user, 38 of them on 30 September 2026. That isolation keeps one account away from another. It does not stop a flaw inside a site from leaking that site&#8217;s own comments, which is why the update matters even with isolation in place.<\/p>\n\n\n\n<h3 id=\"aioseo-vps-and-woocommerce-you-verify-both-layers\" class=\"wp-block-heading\">VPS and WooCommerce: You Verify Both Layers<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A WordPress <a href=\"https:\/\/www.ahosting.net\/vps-hosting.html\">VPS<\/a> leaves package updates and WordPress updates to you, so check both versions. Stores deserve one extra step: update on staging, then run a test checkout on your <a href=\"https:\/\/www.ahosting.net\/woocommerce-hosting.html\">WooCommerce hosting<\/a> account before the live site. Agencies can read the version of every client site in one pass and update them together.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the update does not appear, open a ticket with the WordPress version from Site Health and the PHP version from its Server tab, and we will look at it with you. Anyone on shared <a href=\"https:\/\/www.ahosting.net\/web-hosting.html\">web hosting<\/a> can open wp-includes\/version.php in cPanel File Manager, the file this guide uses to read the version.<\/p>\n\n\n\n<h2 id=\"faq-wordpress-7-1-3-security-release\" class=\"wp-block-heading\">Frequently Asked Questions: WordPress 7.1.3 Security Release<\/h2>\n\n\n\n<h3 id=\"faq-do-i-need-wordpress-7-1-3\" class=\"wp-block-heading\">Do I need the WordPress 7.1.3 security release on my site in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, yes if your site reports 7.1.2 or any earlier 7.1 version. WordPress.org recommends updating immediately because it is a security release. Patchstack says the update is not a drop-everything emergency, so schedule it today, not next month.<\/p>\n\n\n\n<h3 id=\"faq-wordpress-7-1-3-release-date-and-fixes\" class=\"wp-block-heading\">When was the WordPress 7.1.3 security release published and which fixes does it carry?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, WordPress.org published it on 6 October 2026 with seven security fixes and four bug fixes. The fixes cover a Comments screen XSS, a denial of service, an export SQL injection, sticky posts for Authors, comment disclosure, Imgur embeds and a hook name collision.<\/p>\n\n\n\n<h3 id=\"faq-wordpress-7-1-3-install-itself\" class=\"wp-block-heading\">Does the WordPress 7.1.3 security release install itself on every WordPress site in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">However, not on every site. WordPress installs minor releases by default, and a fresh 7.1.2 lab site replaced itself with 7.1.3 within minutes. A constant in wp-config.php, a plugin filter, a locked file system, a Git folder or a stalled WP-Cron can stop it.<\/p>\n\n\n\n<h3 id=\"faq-wordpress-7-1-2-vs-7-1-3-files\" class=\"wp-block-heading\">What changed between WordPress 7.1.2 vs 7.1.3 in the WordPress 7.1.3 security release?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In practice, 15 files differ between the two official archives, and 9 of them are PHP. The changes sit in the HTTP class, the query class, the REST posts controller, the oEmbed class, the export tool, the post status code and the image helper.<\/p>\n\n\n\n<h3 id=\"faq-confirm-wordpress-7-1-3-ahosting\" class=\"wp-block-heading\">How can I confirm the WordPress 7.1.3 security release reached my AHosting WordPress site?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, open Tools, then Site Health, then Info, then WordPress, and read the version. You can also open wp-includes\/version.php in cPanel File Manager and read the wp_version line. Anything below 7.1.3 means the update did not arrive.<\/p>\n\n\n\n<h3 id=\"faq-shared-hosting-vs-vps-wordpress-7-1-3\" class=\"wp-block-heading\">Shared hosting vs VPS: who installs the WordPress 7.1.3 security release for me?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Typically, WordPress core lives inside your own site and updates itself on both. On shared hosting your provider handles the server packages. On a VPS you handle the packages and the application, so you must also verify the core version yourself.<\/p>\n\n\n\n<h3 id=\"faq-wordpress-7-1-2-vulnerable-before-7-1-3\" class=\"wp-block-heading\">Is WordPress 7.1.2 vulnerable until the WordPress 7.1.3 security release is installed in 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, yes, because 7.1.2 lacks the seven security fixes, and my lab showed it leaking private post comments and letting an Author make posts sticky. However, WordPress published no CVE IDs and the coverage I opened reports no confirmed exploitation, so update promptly without panic.<\/p>\n\n\n\n<h3 id=\"faq-imgur-embeds-after-wordpress-7-1-3\" class=\"wp-block-heading\">Which Imgur embeds need attention after the update, and does clearing the cache matter?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, the fix removes Imgur from the trusted embed list but does not remove embeds already stored. Patchstack advises clearing your cache after updating. Review posts that contain Imgur links, especially ones written by Contributor accounts.<\/p>\n\n\n\n<h3 id=\"faq-ahosting-cagefs-wordpress-core-flaw\" class=\"wp-block-heading\">Does AHosting CageFS protect a site from a WordPress core flaw like the comment disclosure?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In practice, no, not from a flaw inside the site itself. CageFS keeps one account from reading another account, but a leaked comment feed is the content of the site itself, served by its own WordPress. Updating WordPress is what closes that kind of flaw.<\/p>\n\n\n\n<h3 id=\"faq-ahosting-help-wordpress-7-1-3-missing\" class=\"wp-block-heading\">How can AHosting help me when the WordPress 7.1.3 security release does not appear under Updates?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, open a ticket and include the WordPress version from Site Health and the PHP version shown under the Server tab. We will look at it with you. Meanwhile, check wp-config.php for a WP_AUTO_UPDATE_CORE or AUTOMATIC_UPDATER_DISABLED line.<\/p>\n\n\n\n<script>\n(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var allH3s = document.querySelectorAll('h3.wp-block-heading');\n    var inFaq = false;\n    for (var i = 0; i < allH3s.length; i++) {\n      var h3 = allH3s[i];\n      var prev = h3.previousElementSibling;\n      if (prev) {\n        if (prev.tagName === 'H2') {\n          var prevId = prev.getAttribute('id');\n          if (prevId) {\n            if (prevId.indexOf('faq-') === 0) {\n              inFaq = true;\n            } else {\n              inFaq = false;\n            }\n          }\n        }\n      }\n      if (inFaq) {\n        initToggle(h3);\n      }\n    }\n    function initToggle(h3) {\n      var answer = h3.nextElementSibling;\n      if (!answer) { return; }\n      if (answer.tagName !== 'P') { return; }\n      answer.style.display = 'none';\n      h3.style.cursor = 'pointer';\n      h3.setAttribute('tabindex', '0');\n      h3.setAttribute('aria-expanded', 'false');\n      h3.addEventListener('click', function(){\n        toggleOne(h3, answer);\n      });\n      h3.addEventListener('keydown', function(ev){\n        if (ev.key === 'Enter') { toggleOne(h3, answer); }\n        if (ev.key === ' ') { ev.preventDefault(); toggleOne(h3, answer); }\n      });\n    }\n    function toggleOne(h3, answer) {\n      var open = h3.getAttribute('aria-expanded') === 'true';\n      if (open) {\n        answer.style.display = 'none';\n        h3.setAttribute('aria-expanded', 'false');\n      } else {\n        answer.style.display = 'block';\n        h3.setAttribute('aria-expanded', 'true');\n      }\n    }\n  });\n})();\n<\/script>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR The WordPress 7.1.3 security release shipped on 6 October 2026 with seven security fixes and four bug fixes. Read your version under Tools, Site Health, Info, WordPress; 7.1.2 or any earlier 7.1 release needs the update. Minor releases install themselves by default, but a handful of switches stop that. In my lab, 7.1.2 handed [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1505,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[8],"tags":[336,335,332,334,333,331,138,330,322],"class_list":["post-1502","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress","tag-wordpress-7-1-3","tag-wordpress-7-1-3-security-release","tag-wordpress-auto-updates","tag-wordpress-comments","tag-wordpress-oembed","tag-wordpress-rest-api","tag-wordpress-security","tag-wordpress-security-update","tag-wordpress-site-health"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"WordPress 7.1.3 security release: 7 fixes in 15 changed files. See what a 7.1.2 vs 7.1.3 lab showed and how to confirm your site updated.\" \/>\n\t<meta name=\"robots\" content=\"max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n\t<meta name=\"author\" content=\"Matt Chrust\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"AHosting Blog | WordPress Hosting Tips &amp; Guides\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"WordPress 7.1.3 Security Release: What Changed | AHosting\" \/>\n\t\t<meta property=\"og:description\" content=\"WordPress 7.1.3 security release: 7 fixes in 15 changed files. See what a 7.1.2 vs 7.1.3 lab showed and how to confirm your site updated.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/wordpress-7-1-3-security-release-ahosting.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/wordpress-7-1-3-security-release-ahosting.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-23T11:17:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-23T11:17:07+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@ahostingdotnet\" \/>\n\t\t<meta name=\"twitter:title\" content=\"WordPress 7.1.3 Security Release: What Changed | AHosting\" \/>\n\t\t<meta name=\"twitter:description\" content=\"WordPress 7.1.3 security release: 7 fixes in 15 changed files. See what a 7.1.2 vs 7.1.3 lab showed and how to confirm your site updated.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@ahostingdotnet\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/wordpress-7-1-3-security-release-ahosting.jpg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/#article\",\"name\":\"WordPress 7.1.3 Security Release: What Changed | AHosting\",\"headline\":\"WordPress 7.1.3 Security Release: What Changed and How to Confirm Your Site Has It\",\"author\":{\"@type\":\"Person\",\"name\":\"Matt Chrust\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/wordpress-7-1-3-security-release-ahosting.jpg\",\"width\":1200,\"height\":675,\"caption\":\"Compare your WordPress version with 7.1.3, then read the fixes. By Matt Chrust, Director of Business Development, AHosting.\"},\"datePublished\":\"2026-10-23T11:17:06+00:00\",\"dateModified\":\"2026-10-23T11:17:07+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/#webpage\"},\"articleSection\":\"WordPress, WordPress 7.1.3, wordpress 7.1.3 security release, WordPress auto-updates, WordPress comments, WordPress oEmbed, WordPress REST API, wordpress security, WordPress security update, WordPress Site Health\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"name\":\"WordPress\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"position\":2,\"name\":\"WordPress\",\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/#listItem\",\"name\":\"WordPress 7.1.3 Security Release: What Changed and How to Confirm Your Site Has It\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/#listItem\",\"position\":3,\"name\":\"WordPress 7.1.3 Security Release: What Changed and How to Confirm Your Site Has It\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"name\":\"WordPress\"},\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/\"}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\",\"name\":\"AHosting\",\"description\":\"WordPress Hosting Tips & Guides\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/assets\\\/img\\\/ahosting-logo.svg\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/ahostingdotnet\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/\",\"name\":\"Matt Chrust\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/795895edac1c44589f6c7f5e6bb79df405fbbaac15817bdd387ec57da61731ec?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Matt Chrust\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/#webpage\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/\",\"name\":\"WordPress 7.1.3 Security Release: What Changed | AHosting\",\"description\":\"WordPress 7.1.3 security release: 7 fixes in 15 changed files. See what a 7.1.2 vs 7.1.3 lab showed and how to confirm your site updated.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/wordpress-7-1-3-security-release-ahosting.jpg\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/#mainImage\",\"width\":1200,\"height\":675,\"caption\":\"Compare your WordPress version with 7.1.3, then read the fixes. By Matt Chrust, Director of Business Development, AHosting.\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wordpress-7-1-3-security-release\\\/#mainImage\"},\"datePublished\":\"2026-10-23T11:17:06+00:00\",\"dateModified\":\"2026-10-23T11:17:07+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#website\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/\",\"name\":\"AHosting\",\"description\":\"WordPress Hosting Tips & Guides\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"WordPress 7.1.3 Security Release: What Changed | AHosting","description":"WordPress 7.1.3 security release: 7 fixes in 15 changed files. See what a 7.1.2 vs 7.1.3 lab showed and how to confirm your site updated.","canonical_url":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/","robots":"max-snippet:-1, max-image-preview:large, max-video-preview:-1","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/#article","name":"WordPress 7.1.3 Security Release: What Changed | AHosting","headline":"WordPress 7.1.3 Security Release: What Changed and How to Confirm Your Site Has It","author":{"@type":"Person","name":"Matt Chrust","url":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/"},"publisher":{"@id":"https:\/\/www.ahosting.net\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/wordpress-7-1-3-security-release-ahosting.jpg","width":1200,"height":675,"caption":"Compare your WordPress version with 7.1.3, then read the fixes. By Matt Chrust, Director of Business Development, AHosting."},"datePublished":"2026-10-23T11:17:06+00:00","dateModified":"2026-10-23T11:17:07+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/#webpage"},"isPartOf":{"@id":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/#webpage"},"articleSection":"WordPress, WordPress 7.1.3, wordpress 7.1.3 security release, WordPress auto-updates, WordPress comments, WordPress oEmbed, WordPress REST API, wordpress security, WordPress security update, WordPress Site Health"},{"@type":"BreadcrumbList","@id":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/#listItem","position":1,"name":"Home","item":"https:\/\/www.ahosting.net\/blog\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","name":"WordPress"}},{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","position":2,"name":"WordPress","item":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/#listItem","name":"WordPress 7.1.3 Security Release: What Changed and How to Confirm Your Site Has It"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/#listItem","position":3,"name":"WordPress 7.1.3 Security Release: What Changed and How to Confirm Your Site Has It","previousItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","name":"WordPress"},"item":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/"}]},{"@type":"Organization","@id":"https:\/\/www.ahosting.net\/#organization","name":"AHosting","description":"WordPress Hosting Tips & Guides","url":"https:\/\/www.ahosting.net\/","logo":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/assets\/img\/ahosting-logo.svg","@id":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/#organizationLogo"},"image":{"@id":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/#organizationLogo"},"sameAs":["https:\/\/x.com\/ahostingdotnet"]},{"@type":"Person","@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author","url":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/","name":"Matt Chrust","image":{"@type":"ImageObject","@id":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/795895edac1c44589f6c7f5e6bb79df405fbbaac15817bdd387ec57da61731ec?s=96&d=mm&r=g","width":96,"height":96,"caption":"Matt Chrust"}},{"@type":"WebPage","@id":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/#webpage","url":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/","name":"WordPress 7.1.3 Security Release: What Changed | AHosting","description":"WordPress 7.1.3 security release: 7 fixes in 15 changed files. See what a 7.1.2 vs 7.1.3 lab showed and how to confirm your site updated.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.ahosting.net\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/#breadcrumblist"},"author":{"@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author"},"creator":{"@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/wordpress-7-1-3-security-release-ahosting.jpg","@id":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/#mainImage","width":1200,"height":675,"caption":"Compare your WordPress version with 7.1.3, then read the fixes. By Matt Chrust, Director of Business Development, AHosting."},"primaryImageOfPage":{"@id":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/#mainImage"},"datePublished":"2026-10-23T11:17:06+00:00","dateModified":"2026-10-23T11:17:07+00:00"},{"@type":"WebSite","@id":"https:\/\/www.ahosting.net\/#website","url":"https:\/\/www.ahosting.net\/","name":"AHosting","description":"WordPress Hosting Tips & Guides","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.ahosting.net\/#organization"}}]},"og:locale":"en_US","og:site_name":"AHosting Blog | WordPress Hosting Tips &amp; Guides","og:type":"article","og:title":"WordPress 7.1.3 Security Release: What Changed | AHosting","og:description":"WordPress 7.1.3 security release: 7 fixes in 15 changed files. See what a 7.1.2 vs 7.1.3 lab showed and how to confirm your site updated.","og:url":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/","og:image":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/wordpress-7-1-3-security-release-ahosting.jpg","og:image:secure_url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/wordpress-7-1-3-security-release-ahosting.jpg","og:image:width":1200,"og:image:height":675,"article:published_time":"2026-10-23T11:17:06+00:00","article:modified_time":"2026-10-23T11:17:07+00:00","twitter:card":"summary_large_image","twitter:site":"@ahostingdotnet","twitter:title":"WordPress 7.1.3 Security Release: What Changed | AHosting","twitter:description":"WordPress 7.1.3 security release: 7 fixes in 15 changed files. See what a 7.1.2 vs 7.1.3 lab showed and how to confirm your site updated.","twitter:creator":"@ahostingdotnet","twitter:image":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/wordpress-7-1-3-security-release-ahosting.jpg"},"aioseo_meta_data":{"post_id":"1502","title":"WordPress 7.1.3 Security Release: What Changed | AHosting","description":"WordPress 7.1.3 security release: 7 fixes in 15 changed files. See what a 7.1.2 vs 7.1.3 lab showed and how to confirm your site updated.","keywords":null,"keyphrases":{"focus":{"keyphrase":"wordpress 7.1.3 security release","score":0,"analysis":[]},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-10-23 11:09:32","updated":"2026-10-23 11:19:17","seo_analyzer_scan_date":null,"focus_keyword":"wordpress 7.1.3 security release","additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ahosting.net\/blog\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/\" title=\"WordPress\">WordPress<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tWordPress 7.1.3 Security Release: What Changed and How to Confirm Your Site Has It\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.ahosting.net\/blog\/"},{"label":"WordPress","link":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/"},{"label":"WordPress 7.1.3 Security Release: What Changed and How to Confirm Your Site Has It","link":"https:\/\/www.ahosting.net\/blog\/wordpress-7-1-3-security-release\/"}],"_links":{"self":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1502","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/comments?post=1502"}],"version-history":[{"count":1,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1502\/revisions"}],"predecessor-version":[{"id":1506,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1502\/revisions\/1506"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media\/1505"}],"wp:attachment":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media?parent=1502"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/categories?post=1502"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/tags?post=1502"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}