Skip to content
PatchBriefing

Search PatchBriefing

Type at least two characters. Results update as you type.

Search CVEs, products, packages and article titles.

Nothing found. Identifiers such as CVE and GHSA can be searched in both languages.

View all search results
Subscribe
7.1.3
RELEASE PATCH WordPress · released October 6, 2026 · covered October 6, 2026

WordPress 7.1.3 Released

WordPress 7.1.3 is now available as a maintenance update to the 7.1 series, with PHP 7.4 recommended for compatibility.

Maintenance release 7.1 branch PHP 7.4 recommended
AI summary

WordPress 7.1.3 has been published on WordPress.org as the latest point release in the 7.1 series. The release notes provided are brief, indicating a routine maintenance update rather than a release tied to specific new features or security advisories. Site owners and administrators running WordPress should be aware of the new version and plan to update their installations in line with normal maintenance practice.

What this release is

WordPress 7.1.3 is listed on the official WordPress.org releases page as the current version in the 7.1 branch. No specific bug fixes, features, or security issues were detailed in the accompanying notes beyond the version number itself and a recommendation to run PHP 7.4. In the absence of further detail, this should be treated as a routine point release intended to keep installations current with the latest supported build.

Compatibility notes

The release notes specify PHP 7.4 as the recommended PHP version for this WordPress release. Site owners should confirm their hosting environment meets this recommendation, as running an outdated or mismatched PHP version can affect plugin and theme compatibility, as well as overall site performance and security posture.

How to update

Most WordPress sites will receive 7.1.3 automatically if automatic background updates are enabled, which is the default for minor and maintenance releases. Site administrators can also trigger the update manually from the Dashboard under Updates, or through their hosting provider's control panel if WordPress is managed externally. As with any core update, it is good practice to ensure a recent backup exists before applying the update, and to verify that active themes and plugins remain compatible afterward.

Synthesized by AI from 1 source · updated 2 hours ago
Sources · merged by AI 1 total
notes ↗
MED 5.7 WordPress 9 Oct WP Rocket: CVE-2026-97076 and CVE-2026-97075 Two vulnerabilities in the WP Rocket WordPress plugin allow (1) code-injection via an executable regular-expression error (CVE-2026-97076) and (2) missing authorization that permits incorrect access (CVE-2026-97075). Both are reported fixed at 3.23.5 in source data, but fix availability is inconsistent in the advisory metadata. [Sources: 4791, 32082, 4790, 32092] Read full report → MED 4.0 WordPress 9 Oct CVE-2026-101324 — Fluent Forms reflected XSS via {get.*} in Custom HTML fields Fluent Forms contains a reflected cross-site scripting (XSS) issue where unauthenticated input via {get.*} SmartCodes in Custom HTML fields can inject script; the issue is addressed in 6.2.15. [CVE-2026-101324] Read full report → HIGH 7.0 WordPress 7 Oct Critical PHP Object Injection Vulnerability in The Events Calendar WordPress Plugin (CVE-2026-95606) A critical deserialization flaw (CVE-2026-95606, CVSS 9.8) in The Events Calendar WordPress plugin allows unauthenticated attackers to perform PHP object injection. No fixed version has been confirmed at the time of writing. Read full report →
The Morning Brief

Relevant changes for the stacks you follow.

Choose your stacks, topics and optional WordPress plugins. At 07:00 CEST, matching advisories and releases from the reporting period are grouped into one email.

Subscribe →

✓ Choose stacks and topics✓ Change preferences anytime✓ One grouped email