WordPress 7.1.3 Released with Critical Security and Maintenance Fixes

WordPress has issued version 7.1.3, featuring seven security fixes and four bug fixes, and urges users to update their sites immediately.

WordPress has announced the release of version 7.1.3, an important maintenance and security update that addresses multiple vulnerabilities and bugs. Because the new version includes seven security fixes alongside four bug fixes, users are strongly advised to update their sites immediately.

The security updates address several reported vulnerabilities, including a stored cross-site scripting issue on the Comments administration page reported by Thomas Chauchefoin of Trail of Bits, and a denial-of-service issue in the WP_Http::make_absolute_url method reported by Anthropic. Anthropic also identified a second-order SQL injection in WordPress WXR export and a weakness allowing Author role users to sticky posts. Additional vulnerabilities resolved in this release include an unauthenticated disclosure of comments on private and unpublished posts reported by Ananda Dhakal from Patchstack, cross-site scripting vulnerabilities in Imgur embeds reported by Zhengyu Liu, Jingcheng Yang, and Gavin Zhong, and a forgeable parameters issue reported by Alex Concha of the WordPress security team.

(adsbygoogle = window.adsbygoogle || []).push({});

Led by Jake Spurlock, the release involved asynchronous coordination from numerous contributors across the community to deliver the stable update. As a courtesy, necessary security fixes are being backported to eligible branches through version 4.7, though developers reiterate that only the most recent version of WordPress receives active support.

Site administrators can download the new version directly from the official project website or initiate the upgrade process through the WordPress Dashboard under the updates menu. Sites that support automatic background updates will begin the process automatically.

(adsbygoogle = window.adsbygoogle || []).push({});