Quick answer: WordPress released three security updates between September 17 and October 6, 2026, ending with version 7.1.3. One of them fixed a flaw that WordPress rated critical. Most sites install these updates on their own, but check today: open the Updates page in your dashboard and confirm your site runs 7.1.3. If it does not, back up and update now.
Below: what each update fixed, the quick check, what to do if your site is behind, and how to update on Turbify hosting.
What did the three WordPress updates fix?
WordPress shipped versions 7.1.1, 7.1.2 and 7.1.3 in three weeks, and each release note tells site owners to update immediately.
| Release | Date | What stands out | Security fixes |
|---|---|---|---|
| 7.1.1 | September 17, 2026 | Stored cross-site scripting and a path traversal flaw | 11 |
| 7.1.2 | September 22, 2026 | A flaw rated critical that can lead to remote code execution | 1 |
| 7.1.3 | October 6, 2026 | Cross-site scripting on the comments screen and an SQL injection in the export tool | 7 |
The September 22 release is the one to take seriously. WordPress describes it as a fix for “a critical severity security vulnerability.” Under certain conditions, an attacker who is not logged in could make WordPress load a PHP file that sits on the server outside your theme folders. If the server and the active theme meet the right conditions, that can let the attacker run their own code on your site, which is why it was rated critical. The flaw is tracked as CVE-2026-87902, and its public record lists every WordPress version before 7.1.2 as affected.
The September 17 release fixed 11 issues, including stored cross-site scripting (a way to plant code in a page that then runs in a visitor’s or an administrator’s browser) and a flaw that let a contributor account overwrite other posts. The October 6 release fixed seven more, including cross-site scripting on the comments screen and an SQL injection (a way to slip commands into your site’s database) in the export tool.
How do you check that your site is on 7.1.3?
For most owners this is a check, not a chore. WordPress installs maintenance and security releases on its own by default on existing sites, according to its guide to updating WordPress (updated July 1, 2026).
- Sign in to your WordPress dashboard.
- Click Updates in the left menu, under Dashboard.
- Read the top of the page. If it says you have the latest version of WordPress, your site is current. If it offers version 7.1.3, your site is behind.
While you are there, look at the plugins and themes listed on the same page. WordPress’s guide says it updates those automatically only in special cases, so keeping them current is usually up to you.
What should you do if your site is behind?
Update today, and back up first. WordPress’s guide and Turbify’s help center both put the backup before the update.
- Back up your site’s files and database. Turbify’s help center shows how to create a backup with WordPress Toolkit.
- On the Updates page, click Update Now.
- Wait for the confirmation at the top of the page. Then open your site in a private browser window and click through your main pages and any contact or checkout form.
- Update your plugins and themes from the same page, one at a time on a busy site, so you know which one caused it if something breaks.
If your site skipped all three releases, its automatic updates may be switched off. That is worth a question to whoever built or manages your site: a site that misses security releases stays exposed until someone notices.
[EXPERT QUOTE SLOT: a Turbify hosting support lead, on why WordPress updates fail and what owners should check first]
For a wider routine, our website maintenance checklist covers the regular tasks around updates, and our guide to essential WordPress plugins helps you trim the ones you no longer use. Fewer plugins means fewer things to keep updated.
How do you update WordPress on Turbify hosting?
If your site runs on Turbify hosting, you have two routes, and our help center walks through both in its article on updating your version of WordPress.
- From the WordPress dashboard: the same Updates page described above.
- From WordPress Toolkit, on plans that include it: sign in to My Services, open Hosting, then WordPress Management. Toolkit can create a restore point before it updates, so you can roll back if something goes wrong, and its Autoupdate setting controls whether WordPress updates itself.
Turbify WordPress hosting includes a free domain and free SSL, and every plan comes with Business Mail accounts.
Quick answers
Does WordPress update itself?
For maintenance and security releases like 7.1.3, yes, by default on existing sites, according to WordPress’s update guide. Plugins and themes work differently, so check them yourself.
Is it safe to update WordPress right away?
Back up first, then update. WordPress asked owners to update immediately after each of these releases, and a backup lets you roll back if a plugin conflicts with the new version.
What is CVE-2026-87902?
It is the public tracking number for the critical flaw fixed in WordPress 7.1.2 on September 22, 2026. Its record lists every WordPress version before 7.1.2 as affected.
My site already shows 7.1.3. Do I need to do anything?
Only the plugin and theme check. WordPress itself is current.
What to do next
Open your Updates page today and note the version you see. If it is not 7.1.3, back up and update, then put a monthly update check on your calendar. For the warning signs that something already got in, read our guide to malware protection for your website.
Get your WordPress site on Turbify hosting, with a free domain, free SSL and Business Mail included. See the WordPress hosting plans.
