WordPress just patched 7 security holes. Here are 3 questions for whoever runs your site.

If you saw a headline this week that said “WordPress security update,” and your stomach did a little flip, good. That’s the right instinct. Now let’s turn it into something useful.

On October 6, WordPress shipped version 7.1.3. According to the official release post, it carries 7 security fixes and 4 bug fixes, and the WordPress team says to update immediately.

I’m not going to walk you through all seven. You don’t run a security team, and you shouldn’t have to. You run a business. What you need is three questions for whoever looks after your site, and a way to read the answers.

What actually happened

The list is a mixed bag. One fix covers a stored cross-site scripting hole in the Comments admin screen. Another covers a denial-of-service issue. Another covers a SQL injection in the export tool. There’s one about Imgur embeds, and one about Author-role users being able to sticky posts.

The one that’s easiest to picture: comments on private and unpublished posts could be seen by someone who wasn’t logged in. If your site has a members area, a draft of an announcement, or anything you marked private on purpose, that’s the kind of thing you’d want to stay private.

Does that mean your site was hacked? No. A patch existing doesn’t mean anyone used the hole on you. It means the hole is now public knowledge, and the clock starts on everyone who hasn’t closed it.

The part that surprised me

Read the “Backports” section of that release post. WordPress says the fixes are being backported, where needed, to every branch still eligible for security fixes, which it says currently runs back through 4.7. That’s a version from late 2016.

It also says the backports “are in progress and will ship as they become ready.” So if your site is on an older version, the patch for your branch might not be out yet, or might have shipped a few days after the main release. And the same post reminds you that only the most recent version of WordPress is actively supported.

Read that twice. Old versions aren’t safe because they’re old and quiet. They’re just last in line.

Question 1: Did my site get 7.1.3?

Simple, yes or no. Not “we keep things updated.” Not “it should have auto-updated.” WordPress does say that sites that support automatic background updates will start the process on their own, but “should have” and “did” are different words.

A good answer sounds like: “Yes, it went on Tuesday, and here’s the version number.” A weak answer sounds like a paragraph that never says yes.

Question 2: Who applied it?

This one catches people. “Who” matters because a lot of sites have an owner in the story, a hosting company in the story, and a developer who built it three years ago and moved on. Everybody assumes someone else has it.

You want a name. A person or a company that says “that’s us, we do that.” If the answer is “I think the host does that,” go ask the host. If the host says “that’s on the site owner,” you just found a gap in your setup that’s been there a while. The weird thing is nobody’s lying. They each think it’s the other one’s job.

Question 3: What’s your window for security updates?

Not whether they update. How fast. When WordPress says “update immediately,” what does immediately mean at your provider? Same day? Within 72 hours? Next monthly maintenance run?

There’s no single right number, but there should be a number, and it should be one they chose on purpose. Security releases are a different category from a plugin tweak. If your provider treats them like any other Tuesday task, that’s worth knowing before the next one.

I wrote more about why that timing is getting tighter in the AI patch window post. Short version: the gap between a patch going public and someone poking at unpatched sites is shrinking.

How to read the answers

• A fast, specific answer. Yes, here’s the version, here’s who did it, here’s our window. Great. Move on with your day.
• A vague answer. “We’re on top of it.” Ask for the version number. If they can’t give you one in a day, treat that as a no.
• Silence. Nobody replies, or the person who built it doesn’t work there anymore. That’s the real answer: nobody is watching your site.

Silence isn’t a crisis by itself. It’s a signal. A site nobody is assigned to look after is a site that gets patched only if somebody happens to log in and notice. That’s firefighting by accident, and it works right up until it doesn’t.

If you got the vague answer or the silence

Two paths, depending on how bad it is.

If you suspect the site is behind or something already looks off, start with our site rescue work: get it patched, get it stable, find out what else is stale. If you just want someone to own this going forward, that’s what website maintenance is for. Our Protect care plan starts at $650/mo with a one-time $750 audit up front, and the full breakdown is on the pricing page.

Not sure what you even need? A short conversation with a WordPress expert usually sorts that out faster than a week of guessing. And if you’re wondering what a good routine looks like, I covered it in stop treating updates like a chore and what proactive monitoring means.

Go ask today

You don’t need to understand a single CVE to do this. Send three questions in one email, see who answers and how quickly, and you’ll know more about the state of your site than most owners do.

And while you wait on those three answers, get a read on the rest of the site. Our free SEO Snapshot shows how you show up in Google and in AI answers right now. It’s a good gut check, and it’s free.

What did your answer look like? I’m curious how many of you got the fast one.