Table of Contents
WordPress 7.1.3 fixes seven security holes, and the WordPress team says to update your site immediately. The WordPress security update shipped on October 6, 2026 and covers seven security fixes plus four bug fixes, including a stored cross-site scripting flaw in the comments screen and a SQL injection flaw in the export tool. If your business website runs on WordPress, the safest move this week is to back up, update, and confirm everything still works.
That matters because your website is often the first place a customer checks before calling. A hacked or broken site costs leads, trust and search visibility. This WordPress security update is not a reason to panic, but it is a reason to act. We are FOG Digital Marketing in San Antonio, and below is the plain English version of what changed and the exact steps to take.
Key Takeaways
- WordPress 7.1.3 was released on October 6, 2026 as a maintenance and security release with 7 security fixes and 4 bug fixes.
- The WordPress team recommends updating your sites immediately, and sites that support automatic background updates will start the update on their own.
- Three of the seven flaws were reported by Anthropic: a denial of service bug, a SQL injection in the export tool, and a permissions bug that let Author users sticky posts.
- One flaw let someone read comments on private and unpublished posts without logging in.
- Security fixes are being backported to older branches back to version 4.7, but WordPress states only the newest version is actively supported.
- A WordPress security update does not patch outdated plugins or page builders, so Elementor and every plugin need their own update check.
What Did the WordPress Security Update Actually Fix?
According to the official post, WordPress 7.1.3 Maintenance and Security Release, the release fixes seven issues. A stored cross-site scripting flaw means an attacker can plant malicious code that runs later when an administrator opens a screen. A SQL injection flaw means bad input can trick the database into doing something it should not. A denial of service flaw means a site can be knocked offline.
Pantheon release notes for WordPress 7.1.3 confirm the same list and add that Pantheon placed a network level virtual patch against the comments flaw, while still telling owners to update. Here is the full list in one place.
| The Fix | What It Means for Your Business |
|---|---|
| Stored XSS on the Comments admin page | Malicious script hidden in a pending comment could run when someone on your team reviews comments. |
| Denial of service in WP_Http::make_absolute_url() | A request could be abused to slow or crash your site, which means missed calls and form fills. |
| Second order SQL injection in the WXR export | Bad data saved earlier could attack your database when an export is run. |
| Author users could sticky posts | A low level account could pin content to the top of your blog, which should be admin only. |
| Comments on private posts exposed | Anyone could read comments on private or unpublished posts without logging in. |
| XSS in Imgur embeds | An embedded image link could be used to run unwanted script. |
| Forgeable status and type hook parameters | Crafted values could cause internal action names to collide. |
Notice that most of these need an attacker to find a weak point first, such as a user account or a comment form. That is why a clean user list and a patched site together matter more than any single fix.
Is My Business Website at Risk Right Now?
If you have not run the WordPress security update, yes, you carry more risk than a patched site does. Public release notes tell attackers exactly where to look, and automated scanners hunt for unpatched sites within days. Small business sites are targeted because they are rarely monitored.
Your risk is higher if your site allows public comments, has several user accounts, uses plugins that have not been updated in months, or has no one assigned to maintenance. Your risk is lower if automatic background updates are on and a professional checks the site monthly. Sites on managed hosting may already be updated, but confirm it rather than assume.
If your site was built by a freelancer who has since moved on, this is the week to find out who owns updates. Our website maintenance services exist for exactly that gap, because the cost of a monthly check is far lower than the cost of a hacked site.
How Do I Run the WordPress Security Update Safely?
Follow the sequence below. The order matters: backup first, then core, then plugins, then testing.
6 Steps to Secure Your Site This Week
Take a full backup first
Use your host backup or a plugin to save the files and database, and confirm you can download it.
Check your version
Open Dashboard, then Updates. If you are not on 7.1.3, or the newest release for your branch, you are exposed.
Update WordPress core
Click Update Now. Sites with automatic background updates may already have it.
Update Elementor, Elementor Pro and plugins
Core fixes do not protect an outdated plugin, and builders are a common entry point.
Review users and pending comments
Delete unknown accounts and look at comments waiting for approval before opening them.
Test the site and the forms
Load your key pages on a phone, submit your contact form and confirm the email arrives.
Most updates finish in minutes, but a rushed update with no backup is how a small problem becomes a weekend outage. If your site is customized or runs a booking or store system, test on a staging copy first.
Does Elementor or My Page Builder Need an Update Too?
Yes, check it the same day. A WordPress security update patches WordPress itself, not the tools built on top of it. Page builders and plugins run a lot of code, so they are a common way in. Elementor publishes release notes on its Elementor Pro changelog page, and recent releases there have included security hardening and stability fixes, so keep both Elementor and Elementor Pro current.
Here is how to think about each layer of your site and who is responsible for it.
| Layer | Who Updates It | How Often to Check |
|---|---|---|
| WordPress core | You, your host or your web team | Weekly, and immediately for security releases |
| Page builder (Elementor) | You or your web team | Weekly |
| Plugins and themes | You or your web team | Weekly, remove any you do not use |
| User accounts and passwords | Site owner | Monthly review, plus any time staff leave |
| Backups | Host or web team | Daily or weekly, test a restore quarterly |
Speed and design also depend on a healthy site. Outdated plugins slow pages down, and slow pages lose visitors. Our San Antonio SEO services include checking for plugin bloat alongside security because the two problems usually travel together.
Will an Outdated Site Hurt My Google Rankings?
It can. A hacked site can be flagged by Google, injected with spam pages, or knocked offline, and any of those can drop your rankings and calls. Even without a hack, a site that crashes or loads slowly gives customers a reason to leave. We covered how rankings can swing in our post on the slow spam update rollout, and a compromised site is one of the fastest ways to get caught in trouble like that.
A WordPress security update is cheap insurance for your search visibility. If you also want to understand how a professionally built site supports leads, our San Antonio web design team builds sites with maintenance and security planned in from the start, and our post on the AI website builder question explains why a DIY site still needs someone watching it.
What Are the Common Mistakes After a Security Release?
- Updating without a backup. If anything breaks, you need a clean copy to restore in minutes.
- Assuming auto updates handled everything. Background updates may fail or skip a site, so check the version number yourself.
- Updating core but ignoring plugins. Outdated plugins are a more common way in than WordPress itself.
- Leaving old user accounts active. Former employees and old freelancers should not keep logins, especially when one fix involved Author level permissions.
- Opening strange pending comments. With a comments screen flaw in the news, delete obvious spam without clicking links.
- Skipping the form test. An update that silently breaks your contact form costs leads for days before anyone notices.
- Running a very old version. WordPress says only the most recent version is actively supported, so old branches are a risk even with backports.
Frequently Asked Questions
What is in the WordPress 7.1.3 security update?
The WordPress 7.1.3 security update fixes seven vulnerabilities and four bugs, released October 6, 2026. The flaws include stored cross-site scripting in the comments screen, a denial of service issue, a SQL injection in the export tool, and exposure of comments on private posts.Do I have to update WordPress manually?
Not always, because sites that support automatic background updates will start the update on their own. You should still log in and confirm the version, since auto updates can be turned off by hosts, plugins or custom settings.How long does a WordPress security update take?
Most sites finish the core update in a few minutes. Allow 30 to 60 minutes for the full process, including a backup, plugin updates and testing your pages and forms.Can I update WordPress without losing my Elementor design?
Yes, a normal update does not delete your pages or Elementor designs, but a backup first protects you if a plugin conflict appears. Update Elementor and Elementor Pro at the same time and view key pages afterward. Our maintenance team handles this for clients every month.Who can update my WordPress site in San Antonio?
FOG Digital Marketing in San Antonio updates, backs up and monitors WordPress sites as part of our website care plans. If you are unsure who maintains your site, ask your host for the current version number and the date of the last backup.
Security releases are routine, but ignoring them is how routine turns into an emergency. Back up, run the WordPress security update, check your plugins, and test your forms this week, and your website keeps doing the one job it has, which is bringing in customers.
Is Your WordPress Site Up to Date?
Security releases move fast, and a missed update can cost you leads. FOG Digital Marketing in San Antonio will check your version, plugins and backups, and tell you exactly what needs attention. Book a free 30 minute call.
Our Blog
Website Design Blogs
WordPress 7.1.3 Fixes 7 Holes: Update Your Site Now
WordPress 7.1.3 Fixes 7 Holes: Update Your Site Now October 20, 2026 Web Design Table of Contents WordPress 7.1.3 fixes seven security holes, and the WordPress team says...
Can an AI Website Builder Build My Business Site?
Can an AI Website Builder Build My Business Site? September 9, 2026 Web Design Table of Contents Yes, an AI website builder can produce a working business website...
Core Web Vitals: Why Slow Sites Are Losing Rankings
Core Web Vitals 2026: Why Slow Sites Are Losing Rankings July 7, 2026 Web Design Table of Contents If your website takes more than 2.5 seconds to show...