WordPress 7.1.3 is out: update now, then get ready for 7.2

WordPress 7.1.3 fixes seven security issues and should be installed today. Here is how to check your site took it, and what to test before WordPress 7.2 lands on December 8.

On October 6, WordPress released version 7.1.3, a maintenance and security release with seven security fixes and four bug fixes. The WordPress team's advice in the release announcement is short: update your sites immediately. It was the third security release in about a month, after 7.1.1 and 7.1.2.

At the same time, WordPress 7.2, the last major release planned for 2026, is about to enter beta. This guide covers both: how to make sure the security update actually reached your site, and what to check before 7.2 arrives so the upgrade is uneventful.

What WordPress 7.1.3 fixes

The release notes list seven security issues, reported by independent researchers, security firms and the WordPress security team itself:

• Stored cross-site scripting (XSS) on the Comments admin screen, which could be triggered through a pending comment.
• A second-order SQL injection in the WordPress export (WXR) feature.
• Disclosure of comments on private and unpublished posts to visitors who were not logged in.
• XSS in Imgur embeds.
• A denial-of-service issue in the function WordPress uses to turn relative links into full URLs.
• Users with the Author role could make posts sticky, which should be an Editor's decision.
• Forgeable hook parameters that could cause one action to be mistaken for another.

None of these needs a dramatic response, but the first three are the kind attackers look for: a comment form is open to the whole internet, and private posts are private for a reason. The fix is to be on 7.1.3, nothing more.

How to check your site is updated

Most WordPress sites install minor security releases automatically in the background. Most is not all. Hosts, security plugins and a single line in wp-config.php can switch automatic updates off, so check rather than assume:

1. 1Log in to your dashboard and open Dashboard → Updates. The top of the page tells you which version you are running. If it says anything below 7.1.3, click Update Now.
2. 2Look for AUTOMATIC_UPDATER_DISABLED or WP_AUTO_UPDATE_CORE set to false in wp-config.php. Either one stops security releases installing on their own.
3. 3If you look after several sites, the WP-CLI command wp core version answers the question in seconds, and wp core update applies the update.
4. 4Take a backup first if your site has not been backed up in the last day. A minor release rarely breaks anything, but a backup makes rarely a non-event. Our backup tutorial covers the options.

Updating WordPress itself is half the job. Most WordPress compromises start with an out-of-date plugin, not core. While you are on the Updates screen, update plugins and themes too, and delete any you no longer use. Our WordPress security guide covers the rest of the list.

WordPress 7.2: the dates

According to the WordPress developer blog, the 7.2 release runs to this schedule:

What is coming in WordPress 7.2

A roadmap is a plan, not a promise, and the WordPress team says plainly that not every item will make the final release. These are the changes that matter most to site owners:

• A new default theme, Ipsum. It is also the end of year-named default themes. Future defaults will be named, so they can change when the design needs it rather than every year.
• Safer Application Passwords (planned): an email when a new one is added to your account and detection of non-HTTPS use. Application Passwords let apps and services log in to your site, so being told when one appears is a real security gain.
• Editor additions, including text shadow as a block style, a grid variation of the Gallery block with columns per screen size, and redrawn icons.
• A Secrets API (tentative), available only through WP-CLI in 7.2, with an interface planned later.

Two changes under the hood are worth knowing about if you have a developer, because they are the most likely to surprise an older site:

• `NO_BACKSLASH_ESCAPES` is off by default. This is a database setting. Sites that depend on it can turn it back on with a db.php drop-in, not a plugin.
• `wp_kses()` is being rebuilt on the HTML API (targeting 7.2 or 7.3). This is the function that cleans HTML in posts and comments. The new version normalises output and rejects some malformed markup, and a wp_kses_force_legacy_parser filter restores the old behaviour while code is updated.

Themes that style the Gallery block or WordPress's built-in icons with custom CSS should be checked too, because both are changing shape.

How to test 7.2 without risking your live site

Never run a beta on the site that takes your bookings or orders. Make a copy and test there:

1. 1Create a staging site, an exact private copy of your live one. Our guide to setting up a WordPress staging site walks through it.
2. 2Install the WordPress Beta Tester plugin on the staging copy and choose the beta or release candidate channel.
3. 3Click through the pages that earn you money: the home page, a service or product page, the contact form, the basket and checkout if you sell online.
4. 4Open the editor and change something. Editor changes are where 7.2 is busiest, so check the blocks you actually use.
5. 5If something breaks, tell the plugin or theme author with the version and steps. During the beta there is still time for them, or WordPress, to fix it.

The WordPress sites that break on update day are the ones nobody looked at during the beta.

Where Serverlys can help

If you would rather not track release schedules at all, this is what our WordPress plans are built around: