Many of us had problems with vulnarity problems with WordPress, now (October 2th 2026) fixed with WordPress 7.1.2 and now (October 6th 2026 with WordPress 7.1.3).
But, be aware, you have to fix potential risks too. I myself had problems while using a very old theme.
To avoid this kind of problems, besides upgrading to WordPress 7.1.2 you have to update the theme, remove all the unused themes, update the plugins. And then you will be less vulnerable in the coming months.
So here is a to do list
- Restore a working backup
- Update to WordPress 7.1.2
- Set a new admin password
- update your latest theme and delete all unused themes
- IMPORTANT: DELETE ALL UNUSED THEMES
- Delete all unnecesary plugins
- update all plugins to the latest version
- create a new backup
- in your wordpress details, change to automatic update
- You’re done!
Difference between WordPress 7.1.2 and 7.1.3
WordPress 7.1.2 was a security release addressing one critical-severity vulnerability. [wordpress.org], [wordpress.org]
WordPress 7.1.3, released on October 6, 2026, goes further and contains 7 security fixes plus 4 bug fixes. WordPress recommends updating sites immediately. [wordpress.org], [wordpress.org]
Among the security issues fixed in 7.1.3 are:
- Stored XSS involving pending comments in the Comments administration page
- A denial-of-service issue in
WP_Http::make_absolute_url() - Second-order SQL injection involving WXR export
- Authors being able to make posts sticky
- Unauthenticated disclosure of comments on private or unpublished posts
- XSS involving Imgur embeds
- A hook-name collision issue involving
{status}_{type}[sharedlicense.com], [patchstack.com]
For your site
Since you’re currently dealing with the WordPress malware problem, I would definitely update from 7.1.2 to 7.1.3. The official WordPress guidance also recommends updating immediately because 7.1.3 is a security release. [wordpress.org]
One important distinction: updating WordPress closes vulnerabilities, but it does not necessarily remove malware that is already present.
