WordPress 7.1.3 Security Update: What Small Business Sites Should Do This Week

WordPress 7.1.3 landed on October 6, 2026 as a maintenance and security release. The official WordPress News post lists 7 security fixes and 4 bug fixes, and tells site owners to update immediately.

If you run a small-business site on WordPress (or you pay someone who does), confirm the update landed this week, clear caches, review who can log in, and poke the pages that make you money. Below: what WordPress published, what that means on a typical service-business site, and a checklist you can finish in about 10–15 minutes. No invented severity scores, and no claims about mass exploitation.

What WordPress 7.1.3 actually fixed

WordPress does not publish CVSS scores in the release note. Treat the list as closed doors. Do not invent a severity ranking WordPress did not publish. In plain terms, the seven security items cover:

1. Stored XSS on the Comments admin page, exploitable through pending comments (reported by Trail of Bits with OpenAI).
2. A denial-of-service issue in WP_Http::make_absolute_url() (reported by Anthropic).
3. A second-order SQL injection in the WXR export tool (reported by Anthropic).
4. Author-role users could sticky posts when they should not have been able to (reported by Anthropic).
5. Unauthenticated disclosure of comments on private and unpublished posts (reported by Ananda Dhakal at Patchstack).
6. Imgur embeds vulnerable to XSS (reported by Zhengyu Liu, Jingcheng Yang, and Gavin Zhong).
7. Forgeable parameters on the {status}_{type} hook that could collide with other action names (reported by Alex Concha of the WordPress security team).

Patchstack’s write-up is useful context: two of these start with an unauthenticated visitor (comment-feed leak; comments XSS that also needs a moderator click), three need a Contributor or Author account, one needs an administrator running an export, and one is plugin-dependent hardening. Their line is “update as soon as you can, but this isn’t a drop-everything emergency.” For most small-business sites, that means: update this week, verify it, then clean house on accounts and caches.

Four maintenance/bug fixes shipped with the release as well. One that small sites notice is image uploads failing with a fatal error on hosts missing PHP’s DOM extension. If media uploads have been broken since WordPress 7.0, testing an upload after 7.1.3 is worth the minute.

Why this matters for a small business site

Most of these issues are not “anyone on the internet owns your server.” Several need a foot in the door: a pending comment, a Contributor or Author account, an export run by an admin, or an embed already on a page. Small sites usually get hurt the same way. Someone leaves an old freelancer account at Author. Comments stay open with no moderation habit. A plugin sits deactivated for two years. The update patches core. The neglected account is still there tomorrow.

WordPress also reminds owners that only the most recent version is actively supported. Security fixes are being backported to older eligible branches (currently through 4.7), and those backports ship as they become ready. A courtesy backport is not the same as staying current. If you can move to 7.1.3 after a backup and a quick staging check, do that instead of waiting on older-branch patches.

The “auto-update already handled it” myth

WordPress says sites that support automatic background updates will begin updating on their own. That sentence has three soft spots:

• Some hosts turn auto-updates off.
• Some developers turn them off “so nothing breaks,” then forget.
• Even when auto-updates are on, nobody has promised your site a clock time. A site that missed the release looks identical to a site that got it until someone opens Dashboard → Updates.

Do not assume. Open Updates and read the version number. You want WordPress 7.1.3 (or newer if another release has already shipped by the time you read this). If you manage more than one site, check each one. Managed hosts sometimes lag or stage core behind a control panel toggle. Confirm the version on the live site, not only in a host email.

Backup before you update

Before you click Update Now:

1. Confirm you have a restorable backup of files and the database (host snapshot, backup plugin, or both). A backup you cannot restore is theater.
2. Note your current WordPress, PHP, theme, and plugin versions somewhere you can find them if you need to roll back.
3. If the site runs booking, memberships, payments, or heavy custom code, prefer a staging copy first. For a simple brochure site with a contact form, a fresh backup plus a careful update is usually enough.

Then update from Dashboard → Updates → Update Now, or follow your host’s managed update flow. After core finishes, complete any database update prompt WordPress shows.

Your 10–15 minute owner checklist

Use this as a single pass. Set a timer if that helps.

1. Confirm core version. Dashboard → Updates. Confirm 7.1.3 (or newer).
2. Clear caches. Page cache plugin, host cache, CDN if you use one, and browser cache for your own spot-check. Patchstack notes that updating does not wipe already-cached oEmbed content, so old Imgur embeds can keep rendering until cache is cleared.
3. Test one image upload. Media → Add New. If uploads failed after 7.0, this release may have fixed it.
4. Review plugins and themes. Apply available updates after the core update (backup first if you have not already). Prefer security releases the same day you see them.
5. Delete what you do not use. Deactivated is not deleted. A deactivated plugin with a hole is still a hole sitting on disk. Remove abandoned plugins and unused themes. Keep one default theme as a fallback if your host expects it.
6. Audit users. Users → All Users. Sort by role. Remove people who left. Downgrade anyone who only needs to draft. Pay special attention to Author and Contributor accounts; several 7.1.3 fixes involve what those roles could reach.
7. Check comments. If you accept comments, review the Pending queue. Moderate or trash junk. Consider tighter settings (manual approval, disable comments on old posts) if you do not actively use them.
8. Private and draft content. Glance at private posts and anything marked unpublished. One fix in this release covered comment disclosure on private/unpublished posts. Confirm private content is still private after the update.
9. Post-update QA (next section). Spend five minutes on the money paths.
10. Update contact for admin emails. Make sure WordPress and host alerts go to an inbox someone still reads.

Plugins, themes, deleted vs deactivated

Core 7.1.3 closes the listed WordPress core issues. Plugins and themes ship on their own calendars. A dashboard full of red update badges is a to-do list, not decoration.

Practical rules that hold up for service businesses:

• Update core first on security releases, then plugins/themes.
• Read the changelog when a plugin update mentions “security.”
• Delete unused plugins instead of leaving them deactivated for “someday.”
• If a plugin has not been updated in years and the vendor is gone, replace it. Abandoned code is how quiet compromises start.
• Theme child customizations belong in a child theme or a small custom plugin, not in the parent theme files you overwrite on every update.

Author and Contributor audit (do this even if core is current)

Open Users and ask for each account:

• Does this person still need access?
• Do they need this role, or would Contributor / a custom lower role do?
• Was this account created for a one-off blog post, a former VA, an old agency, or a seasonal hire?

Several of the 7.1.3 fixes assume someone can already log in at Contributor or Author. Cleaning the user list shrinks that surface for this release and the next one. While you are there, confirm two-factor authentication is on for administrators if your host or a security plugin offers it, and rotate passwords for any shared “marketing@” style logins.

Comments, moderation, and private posts

If your site takes comments:

• Empty or triage Pending comments after the update.
• Turn on manual approval if you are not actively replying to comments every week.
• Close comments on old posts that no longer need discussion.

If you use private posts for internal drafts, client previews, or staff-only notes, load one private URL while logged out (or in a private browser window) and confirm visitors cannot see the content or its comments. The disclosure fix in 7.1.3 is exactly about comments leaking from private/unpublished posts through feeds. A two-minute logged-out check beats assuming the patch “probably” applied cleanly.

Post-update QA: homepage, forms, booking, checkout, login, mobile

After core + cache clear, click through the paths that pay the bills:

• Homepage and main service pages load without layout breakage.
• Contact form submits and you receive the notification.
• Booking or scheduling widget still opens and completes a test booking (cancel it after).
• Checkout or payment form, if you have one, reaches the payment screen on a test item.
• wp-login still works for your admin account.
• Mobile view: menu, phone tap-to-call, and form fields usable with a thumb.

If something breaks, stop clicking Update repeatedly. Capture the error, check the host error log, and restore from the backup you took before the update. A short maintenance window is cheaper than improvising while customers are on the site.

When to call a developer

Handle the checklist yourself when the site is a standard theme + common plugins and you have a working backup. Call a developer (or your maintenance partner) when:

• The update fails or the site whitescreens.
• You are several major versions behind and plugins look incompatible.
• You run custom code, memberships, multi-site, or heavy WooCommerce.
• You cannot get a restorable backup.
• You find unknown admin users, odd scheduled posts, or files you did not install.

Bring them the version you were on, the backup timestamp, and what you already tried. That saves an hour of discovery billed at developer rates.

Soft next step if you want help watching the site

If you would rather not babysit plugin badges every Monday, IntuiCo builds and maintains WordPress and modern sites for service businesses nationwide. Start with our web design services overview, or see SEO if search visibility is the bigger gap. No hard sell: the job this week is still “confirm 7.1.3, clear caches, clean users, test forms.”

Sources

• WordPress 7.1.3 Maintenance and Security Release (WordPress News, October 6, 2026)
• WordPress 7.1.3 Security Release (Patchstack)

Update the core, verify the version, clear the caches, shrink the user list, and test the forms that bring in work. That is the whole job for this release.