On October 6, 2026, WordPress released version 7.1.3, a maintenance and security update.
If any of the websites you maintain somehow missed the automatic update, take care of that before reading the rest of this post!
This release includes 7 security fixes and 4 bug fixes. Today, I want to focus on one particular security issue: DoS (Denial-of-Service).
What does this vulnerability mean, and which part of the WordPress core code was responsible for it?
What Is a DoS Vulnerability?
Generally, a Denial-of-Service (DoS) vulnerability is a security flaw that can make a website, server, or network resource unavailable to legitimate users by exhausting system resources or disrupting normal operations.
Technical Analysis: The Problematic Code
WordPress includes the WP_Http class, which handles HTTP-related functionality. Within this class, the make_absolute_url() method processes URLs and their paths.
Source: WordPress 7.1.2 — class-wp-http.php
// Strip all /path/../ out of the path.
while ( strpos( $path, '../' ) > 1 ) {
$path = preg_replace( '![^/]+/\.\./!', '', $path );
}This loop is intended to remove path segments containing ../, such as a/../b.
However, a malformed relative path such as a//./b can cause the regular expression to make no progress while the loop’s condition remains true. As a result, the loop can run indefinitely, potentially exhausting server resources.
In a vulnerable execution path, this behavior could lead to a Denial-of-Service (DoS) condition.
How WordPress 7.1.3 Fixes the Issue
In WordPress 7.1.3, the code was improved to detect whether the regular expression actually replaced any path segments.
Source: WordPress 7.1.3 — class-wp-http.php
// Strip all /path/../ out of the path.
while ( strpos( $path, '../' ) > 1 ) {
$path = preg_replace( '![^/]+/\.\./!', '', $path, -1, $segment_replacement_count );
if ( 0 === $segment_replacement_count ) {
break;
}
}The key improvement is the $segment_replacement_count parameter.
PHP’s preg_replace() function can report how many replacements it made through this parameter. If no replacement occurs, the loop now exits instead of continuing indefinitely.
This prevents the loop from getting stuck when it cannot make further progress, helping protect server resources from this particular failure scenario.
You can review the complete change in the official WordPress core commit.
Why Should You Keep WordPress Updated?
Regular WordPress updates help you benefit from:
- Security protection: Address known vulnerabilities.
- Bug fixes: Resolve issues affecting website functionality.
- Performance improvements: Benefit from optimizations included in releases.
- New features and tools: Access new capabilities when available.
- Compatibility: Help maintain compatibility with supported plugins, themes, and technologies.
Keeping WordPress updated is an essential part of maintaining a secure, stable, and sustainable website.
Don’t be late to the WordPress 7.1.3 party! 🎉
Update your WordPress websites and keep them secure.