WordPress released 7.1.3 on 6 October 2026, with seven security fixes and four bug fixes. If you manage several sites, checking which ones have installed it is a useful job for today.

The official release announcement recommends updating immediately. Background updates can take care of eligible sites, but an enabled setting is only part of the story. You still need to confirm the installed version.

What the release fixes

The fixes cover several parts of WordPress, including comments, exports, embeds and permissions. They include stored cross-site scripting on the comments administration page, an SQL injection issue in WXR exports and disclosure of comments on private or unpublished posts.

That range matters because a site can use vulnerable core functionality without having an obvious public comment section. The release announcement does not establish that your particular site has been attacked.

A version check beats an assumption

For an agency, start with a list of every production installation and its current version. Include quiet brochure sites and old campaign sites. They are easy to miss when most support requests come from a busy shop.

For each site, record who controls updates. Is it your team, the client or the hosting provider? If the responsibility is shared, agree which person confirms completion. Two teams can both assume the other one has done it.

A failed background update deserves a clear owner and a next action. Check the reported error and available disk space, then use the normal update process for that installation. Keep a current, restorable backup available while you do the work.

Test the parts people use

The useful check after an update is a short customer journey. Open the site in a fresh browser session, submit a test enquiry and confirm the message arrives. For a shop, use its approved test payment route to check basket and checkout behaviour.

Also check administrator access and any scheduled imports or exports your business relies on. A page can look normal while a background task has stopped working.

  • Confirm the installed WordPress version.
  • Check the home page and a representative inner page.
  • Test forms, account access and checkout where relevant.
  • Review update errors and application logs.
  • Record completion against the site inventory.

Give neglected sites a decision

An old site that nobody wants to maintain still needs attention. Decide whether to update it, move its useful content or retire it through an agreed process. Leaving it online indefinitely creates an ongoing maintenance obligation.

WordPress says security fixes are being backported to eligible older branches, while only its most recent version is actively supported. Check the announcement for your branch rather than assuming every installation receives the same package.

The immediate task is manageable: find the sites, confirm the update and test their essential functions. Put the results somewhere your team can find them the next time a security release arrives.

Reporting checked on 13 October 2026.