WordPress 7.1.3 patches seven security bugs, three from Anthropic
The maintenance release fixes stored XSS, SQL injection, an unauthenticated comment leak and a privilege-escalation bug in core. WordPress says to update immediately.
WordPress shipped 7.1.3 on 6 October, a maintenance and security release fixing seven vulnerabilities in core, three of them found by Anthropic’s own security team.
The list: a stored XSS on the Comments admin page reachable via pending comments (Thomas Chauchefoin, Trail of Bits), a second-order SQL injection in the WXR export tool, a denial-of-service bug in WP_Http::make_absolute_url(), a flaw that let Author-role users sticky posts they shouldn’t be able to pin, an unauthenticated disclosure of comments on private and unpublished posts (Ananda Dhakal, Patchstack), an XSS in Imgur embeds, and forgeable parameters in the {status}_{type} hook. Four unrelated bug fixes ship alongside. WordPress recommends updating straight away rather than waiting for a maintenance window.
Why it matters: these are core bugs, not plugin bugs, so they reach every WordPress site regardless of what’s installed. The SQL injection and the comment-disclosure flaw are the ones worth treating as urgent if you handle WXR exports or run a comments section with private or unpublished posts in the mix.
The caveat: WordPress hasn’t assigned CVE numbers to any of these yet, so you can’t verify a host’s patch status against a CVE ID — check the version number in your dashboard instead. Anything on 7.1.2 or earlier needs the update.