The latest WordPress update, version 7.1.3, addresses seven security vulnerabilities and fixes four software bugs. The release aims to improve the platform's core security and resolve issues identified by external researchers and the internal development team.
Three of the reported security flaws were discovered by the AI company Anthropic. Other contributors include Trail of Bits and Patchstack, who each reported one vulnerability, while three independent researchers submitted another. The WordPress security team identified the final vulnerability independently.
A notable security issue involves a stored cross-site scripting (XSS) vulnerability in the comment management interface, reported by Thomas Chauchefoin from Trail of Bits. This flaw allows malicious scripts to trigger when an administrator accesses the pending comment queue.
Anthropic's findings include a vulnerability in the WXR exporter, which poses a risk when a user executes a content export. Additionally, the update addresses a denial-of-service vulnerability within the WP_Http::make_absolute_url method and a privilege escalation issue that allowed authors to mark posts as sticky.
