Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
6.3.13
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 6.3.13 Released

WordPress 6.3.13 is now available as a maintenance release for the 6.3 branch, recommended to run on PHP 7.0.0 or newer.

Maintenance release for 6.3 branch Recommended PHP 7.0.0+
AI summary

WordPress 6.3.13 has been published as the latest maintenance build in the 6.3 series. Releases like this typically keep older branches current with minor fixes, and this one is worth noting for any site still running on 6.3.x rather than a newer major version.

What this release contains

The official WordPress.org release listing confirms that version 6.3.13 is now available, with PHP 7.0.0 listed as the recommended minimum PHP version for running it. No additional details about specific bug fixes were included in the source notes, which is common for routine point releases that primarily backport maintenance updates to an older branch.

Who this affects

This update applies to sites that are intentionally running the WordPress 6.3 branch rather than the current major release line. If your site has not been upgraded to a newer major version of WordPress, applying 6.3.13 keeps you aligned with the latest fixes available for that branch. Sites already on a newer major version (6.4 and beyond) are unaffected by this specific release.

Upgrade notes

As with any WordPress core update, taking a full backup of files and database before updating is good practice. Most sites with auto-updates enabled for minor releases will receive 6.3.13 automatically; others can update manually from the WordPress dashboard or via WP-CLI. Confirm your hosting environment meets the recommended PHP 7.0.0 baseline, and verify core plugins and themes remain compatible after the update.

Synthesized by AI from 1 source · updated 2 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email