On October 6, 2026, WordPress released version 7.1.3 — a security update that fixes seven vulnerabilities in the software’s core. On its own, that would be routine. What is not routine is the company it keeps.
WordPress 7.1.3 is the third security release in less than three weeks, following 7.1.1 on September 17 and 7.1.2 on September 22. It is the sixth security release since the middle of July. Add up the fixes across those six releases and WordPress has closed 34 security holes in its core code in under 12 weeks.
For most of WordPress’s history, core security releases arrived a few times a year, and the serious problems lived in plugins. That second part has not changed — Patchstack’s State of WordPress Security report counted 11,334 new vulnerabilities across the WordPress ecosystem in 2025, with 91 percent of them in plugins and only six in core. But core is now being examined far more closely than ever before, and the credits on the release notes reveal who is doing the examining.
Three of the seven fixes in 7.1.3 are credited to Anthropic, the AI company. Two more in 7.1.1 carry the same credit. The pattern is unmistakable: artificial intelligence is now finding WordPress flaws faster than human researchers ever did, and site owners need to understand what that means for how they maintain their websites.
This article breaks down exactly what changed in WordPress 7.1.3, why this rapid-fire release cycle matters, and what you should do about it right now.
What WordPress 7.1.3 Actually Fixes
WordPress 7.1.3 is a security and maintenance release. All seven vulnerabilities it addresses are in WordPress core — the files that ship with every WordPress installation. The release notes credit discoveries to multiple security researchers, with AI-assisted research playing a prominent role.
The vulnerabilities span several categories that WordPress users should understand:
Cross-site scripting (XSS) flaws allow attackers to inject malicious scripts into pages viewed by other users. When these exist in core — particularly in the admin dashboard or comment handling — they can be exploited to hijack administrator sessions.
Cross-site request forgery (CSRF) issues trick logged-in users into performing actions they did not intend, such as changing settings or creating user accounts, simply by visiting a malicious page while logged into their WordPress admin.
Privilege escalation vulnerabilities are among the most serious. These allow users with low-level accounts (such as subscribers) to gain higher-level permissions they should not have — potentially full administrator access.
Information disclosure flaws leak data that should remain private, such as user details, configuration information, or internal paths that help attackers plan further attacks.
SQL injection vulnerabilities, while less common in modern WordPress core, allow attackers to manipulate database queries — potentially reading, modifying, or deleting any data in the WordPress database.
WordPress does not publish full technical details of security fixes at release time. This is deliberate: disclosing exact exploit methods before most sites have updated would hand attackers a roadmap. Full details typically emerge weeks later through researcher write-ups.
What matters for site owners is not the technical minutiae of each flaw but the pattern: seven core vulnerabilities, found largely through AI-assisted research, fixed in a single release, arriving just two weeks after the previous security update.
Why AI Is Finding WordPress Flaws Faster Than Ever
The most significant story behind WordPress 7.1.3 is not any single vulnerability — it is who found them.
Three of the seven fixes credit Anthropic. Two of the fixes in 7.1.1 carried the same credit, alongside one shared with pwn.ai, a firm that sells autonomous penetration testing. The critical chain patched in 7.0.2 was found by AI-assisted research running against WordPress core, producing a working attack that needed no login in about ten hours, at a cost estimated at roughly $25.
The WordPress bug bounty programme, which covers core, WordPress.org infrastructure, and official plugins, received monthly reports in the dozens for nine years before climbing to 450 in July 2026.
This is a fundamental shift in the security landscape. For two decades, finding vulnerabilities in WordPress core required skilled human researchers spending days or weeks on manual code review. Now, AI systems can scan the entire WordPress codebase systematically, testing thousands of potential attack paths in hours, at trivial cost.
The implications are straightforward:
Vulnerabilities will be found faster. The 34 core fixes in 12 weeks is not a sign that WordPress code quality has collapsed — it is a sign that discovery has accelerated dramatically. Flaws that might have sat unnoticed for years are now being surfaced in weeks.
Patching speed matters more than ever. When AI can find a vulnerability in hours for $25, attackers have access to the same capability. The window between a flaw’s discovery and its exploitation is shrinking. Sites that delay updates are exposed for longer in a landscape where exploitation comes faster.
Security releases will come more often. The days of two or three core security updates per year are over. Site owners should expect the current pace — a security release every few weeks — to become the new normal.
This is actually good news in the long run. Faster discovery means faster patching, which means a more secure WordPress overall. But it demands a change in how site owners think about updates: from occasional maintenance to continuous vigilance.
The 7.1.x Release Timeline: What the Pace Tells Us
To understand why WordPress 7.1.3 matters, it helps to see the full recent timeline:
- Mid-July 2026: Security release addressing critical issues, including an AI-discovered attack chain
- August 2026: WordPress 7.0.4 fixes a remote code execution flaw found through autonomous penetration testing
- September 17, 2026: WordPress 7.1.1 security release
- September 22, 2026: WordPress 7.1.2 security release
- October 6, 2026: WordPress 7.1.3 fixes seven vulnerabilities
Six security releases in under three months. Thirty-four core vulnerabilities patched.
Compare this to the historical norm. In 2025, Patchstack counted only six core vulnerabilities for the entire year. The WordPress security team was dealing with a handful of core issues annually, with the real firefighting happening in the plugin ecosystem.
The acceleration is entirely driven by AI-assisted discovery. The code did not suddenly get worse — the examination got dramatically better and cheaper.
For site owners, the practical takeaway is that the update treadmill is speeding up. A site that was “fully updated” in early September needed three more updates by early October. Maintenance is no longer a quarterly task; it is an ongoing discipline.
What You Should Do Right Now
If your site is running any version of WordPress 7.1 below 7.1.3, update immediately. Here is a practical checklist:
1. Back Up Before You Update
Always create a complete backup — files and database — before applying any core update. If something goes wrong, you need a restore point. Most quality backup solutions can create a full backup in minutes. Store the backup off your server, not on it.
2. Update WordPress Core to 7.1.3
Go to Dashboard → Updates in your WordPress admin and apply the 7.1.3 update. For most sites, this is a one-click process that takes under a minute. If you have automatic background updates enabled for minor releases (the default), your site may have already updated itself — verify by checking the version number in the bottom-right corner of your admin dashboard or in the “At a Glance” widget.
3. Update Everything Else Too
Core security releases often coincide with a wave of plugin and theme updates. After updating core, update all plugins and themes. Pay particular attention to security-related plugins and any plugin that handles user input, file uploads, or forms — these are the most common attack vectors.
4. Verify Your Site Still Works
After updating, check your homepage, a few key pages, and any critical functionality (contact forms, checkout pages, login). Security updates are designed to be safe, but every site’s combination of themes and plugins is unique. A quick visual check takes two minutes and catches most issues.
5. Review User Accounts
Given that some of the patched vulnerabilities involve privilege escalation, take a moment to review your user list. Remove any accounts you do not recognize, demote any users who have more access than they need, and ensure no old test accounts with administrator privileges are lingering.
6. Enable Automatic Updates If You Have Not
WordPress has supported automatic background updates for minor releases since version 3.7. If your site does not already auto-update, consider enabling it. In an era of security releases every few weeks, manual updating creates windows of exposure that automatic updates close. You can enable auto-updates for major releases too, though many site owners prefer to test major updates first.
Why This Matters Beyond 7.1.3
WordPress 7.1.3 is a single release, but it represents a turning point. The combination of AI-accelerated vulnerability discovery and WordPress’s massive installed base — powering over 40 percent of the web — creates a security dynamic that rewards the prepared and punishes the complacent.
Sites that update promptly, maintain good backups, follow the principle of least privilege for user accounts, and use reputable themes and plugins from developers who patch quickly will be fine. The vulnerabilities are being found and fixed; the system works, as long as site owners participate by updating.
Sites that run outdated versions, ignore update notifications, or use abandoned plugins are taking on increasing risk. As AI makes vulnerability discovery cheaper and faster, the cost of neglect rises.
This is also why the source of your themes and plugins matters enormously. A theme or plugin from a developer who responds to security reports within hours is a fundamentally different risk proposition than one from a developer who last updated their code two years ago. When you choose products for your WordPress site, you are choosing a security partner, not just buying features.
At HyperDAF, every theme, plugin, and template is built by world-class expert developers who treat security as a core feature, not an afterthought. When you build your site on professionally maintained products, you get the benefit of rapid security response — the kind of diligence that keeps pace with an AI-accelerated threat landscape.
The Bottom Line
WordPress 7.1.3 fixes seven core vulnerabilities and continues an unprecedented pace of security releases driven by AI-assisted research. Update now, back up first, and treat site maintenance as an ongoing discipline rather than an occasional chore.
The AI era of vulnerability discovery is here. The sites that thrive in it will be the ones whose owners — and whose product developers — take security seriously every single week, not just when headlines appear.
—
Key takeaways:
- WordPress 7.1.3 (October 6, 2026) fixes 7 core security vulnerabilities
- It is the 3rd security release in 3 weeks and the 6th since mid-July — 34 core flaws patched in 12 weeks
- AI-assisted research (including Anthropic) is finding flaws dramatically faster and cheaper than before
- Update immediately, back up first, review user accounts, and consider enabling auto-updates
- Choose themes and plugins from developers who patch quickly — your product choice is a security choice
1 comment