CriticalCVE
Critical WordPress Vulnerabilities Enable XSS, SQL Injection and Data Disclosure Attacks
Cyber Security News·Source published ·1 min read
What happened?
WordPress released version 7.1.3 on October 6, 2026, addressing vulnerabilities involving cross-site scripting, SQL injection, information disclosure, and other security weaknesses. The project recommends immediate updates, with fixes also available for older affected branches. Only the latest WordPress version remains actively supported. The release documentation lists seven security issues, although its introductory sentence describes “one security fix.” It provides no CVE identifiers, severity scores, or confirmed exploitation details.
Key details
- WordPress 7.1.3 was released to fix multiple vulnerabilities including XSS, SQL injection and information disclosure.
- A second‑order SQL injection vulnerability is present in the WordPress WXR export feature.
- Unauthenticated attackers can retrieve comments tied to private or unpublished posts.
- Users with the Author role can improperly set posts as sticky, indicating an authorization flaw.
Affected
- WordPress version 7.1.3 is the primary affected release.
- Older WordPress branches also receive the same security fixes.
- Comments administration page is vulnerable to stored XSS.
- Comments on private or unpublished posts can be disclosed without authentication.
- Author role can make posts sticky, a privilege escalation issue.
- {status}_{type} hook parameters can be forged, causing action name collisions.
Fixes and mitigations
- Update to WordPress 7.1.3 via Dashboard > Updates or the official releases page.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.