WordPress Security Update: AI Helped Find Bugs. Your Turn.

WordPress shipped version 7.1.3 on October 6, and it patches seven security holes. Four of them were reported by AI outfits (Anthropic on its own, and Trail of Bits working with OpenAI). So the robots are now reading WordPress code more carefully than most people read their own website.

That’s not a crisis. It’s a nudge. The folks hunting for holes in WordPress have better tools than ever, and not all of them send polite reports.

The short version

• WordPress 7.1.3 fixes 7 security issues and 4 bugs, and WordPress says to update your sites immediately.
• Most sites pick up core security releases automatically. Plugins and themes are a whole different story.
• If nobody logs into your site, nobody knows whether any of it actually updated. Somebody has to check.

What did WordPress 7.1.3 actually fix?

It fixed seven security issues and four regular bugs. The release notes list a stored cross site scripting (XSS) problem on the Comments screen, a SQL injection in the export tool, a denial of service issue, a way for users with the Author role to make posts sticky, an XSS problem in Imgur embeds, and a leak that let anyone see comments on private and unpublished posts without logging in.

Translation for normal humans: most of these need some kind of foot in the door. A pending comment. An author account. A weird embed. None of it is the sky falling.

But “needs a foot in the door” is exactly how small business sites get hacked. Somebody leaves the door cracked. (Usually it’s a contributor account for a guy who wrote one blog post in 2021 and was never heard from again.)

The full list is in the official 7.1.3 release post if you like reading security notes with your coffee.

Does my WordPress site update itself?

Usually, yes, for core security releases like this one. WordPress says sites that support automatic background updates will start updating on their own.

The word “support” is doing a lot of heavy lifting there. Some hosts switch it off. Some developers switch it off so nothing breaks, then forget they did. And some sites are so old they’re limping along on a branch that only gets backported fixes, while WordPress itself says only the newest version is actively supported.

Then there are plugins. Plugins live on their own schedule. A plugin with auto updates turned off just sits there with its known hole, politely waiting for someone to click a button that nobody’s going to click.

I see this all the time: a dashboard with eleven red update badges and an owner who figured those were notifications about something fun. They’re not. They’re a to do list the internet can read.

Why does AI finding WordPress bugs matter for a small business?

Because it cuts both ways. The same kind of tools that helped report these bugs can help somebody go looking for the next ones, and those tools don’t get bored at 2 a.m.

Hacking a small business site isn’t usually personal. Your bakery’s website isn’t getting poked because someone hates croissants. It’s getting poked because it showed up on a list of sites running an old version of something. Scan a million sites, find the ones that didn’t update, walk right in. That’s the whole business model.

So “eh, I’ll update it later” hits different now. Once a fix is public, the hole is public too. Every day between the patch and your update is a day your site is basically wearing a sign that says “spare key under the mat.”

The good news? This release is proof the system works. Bugs got found, reported quietly, fixed and shipped. The only part of the chain that can still drop the ball is the last one, which is you (or whoever you’re paying to watch your site, if anyone).

What should I do this week?

Log in and look. Honestly, that’s most of it. Here’s the ten minute version:

1. Go to Dashboard, then Updates. If it shows 7.1.3 or newer, core is handled.
2. Take a backup. Then update your plugins and themes. Backup first, every time. That’s how you cover your ass when an update decides to break your contact form.
3. Delete plugins you don’t use. Deactivated isn’t deleted. A deactivated plugin with a hole is still a hole, it’s just a quiet one.
4. Check your user list. Anybody who doesn’t need an account shouldn’t have one, especially Authors and Editors. One of this week’s fixes was literally about what Authors could get away with.
5. Make sure the update emails go to someone who reads them. An alert sent to a dead inbox is a smoke detector installed in the neighbor’s garage.

If that list made your eyes glaze over, fair. Remembering plugin updates on top of running an actual business is a pain in the ass, and it’s exactly what my website maintenance work is for. A neglected site usually has other tells too, like the ones in my post on outdated website signs.

Questions people ask

Is WordPress safe for a small business website?

Yes, when somebody’s actually maintaining it. WordPress core gets fixed quickly and in the open, which is what you want. Most break ins come from outdated plugins, weak passwords and forgotten accounts, not WordPress itself.

How often should I update WordPress plugins?

Check at least once a week and apply security updates right away. Back up first, update, then click around the site to make sure forms, booking and checkout still work.

Should I turn on auto updates for everything?

For a lot of small sites, that’s a reasonable call, as long as you have daily backups and someone glances at the site afterward. Auto updates with no backups is just gambling with a nicer interface.

Here’s my take. WordPress did its job this week, and the AI folks did theirs. The weak link was never the code, it’s the half-assed “set it and forget it” habit that leaves a site running whatever it had on launch day. If you’d rather never think about plugin badges again, tell me about your site and I’ll keep an eye on it so you don’t have to.