WordPress Ships Its Third Update in Three Weeks, With Seven Security Fixes

WordPress released version 7.1.3 on 6 October, its third update since 17 September. The release announcement lists seven security fixes and four bug fixes, and says that because it is a security release, "it is recommended that you update your sites immediately."

Most of the seven are technical, but a few are easy to picture. One lets someone read comments on posts that are private or not yet published, without logging in. Another lets a user with the Author role do something to sticky posts that the role should not allow. Two more are cross-site scripting flaws, one in the comments screen of the admin area and one in Imgur embeds. The announcement credits the people who reported each one.

If you run a WordPress site, the question is which version it is on now. The announcement says that sites which support automatic background updates will begin the update on their own. Whether yours does depends on how it is hosted and set up, so do not assume. The Updates screen in the WordPress Dashboard shows the version running and offers the update if it has not arrived. It takes a couple of minutes.

The announcement also says the fixes are being backported to older branches, through 4.7, but adds that only the most recent version of WordPress is actively supported. If a site is stuck on an old version, that is the bigger problem to sort out.

Three releases in under three weeks is a lot to keep up with if nobody owns the job. Our guide on keeping a small business website secure covers who should be watching for updates like this one. If you would rather not do it yourself, get in touch and we will talk through what looking after a site involves, with care plans from £69 a month.