WordPress 6.4.13

WordPress 6.4.13 has 12 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2026; all 12 are fixed as of October 2026. Their average CVSS score is 4.8, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 2 high. 2026 was the busiest year with 11 disclosures.

The most common weakness is Missing Authorization, behind 3 of the records (25%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Improper Neutralization Of Input During Web Page Generation.

Every one of the 12 issues recorded for WordPress 6.4.13 has a vendor fix available, so running the current release closes all known holes.

10 independent researchers contributed these findings, most of them (2) reported by Anthropic.

Strategic Overview

Avg CVSSMedium

4.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WordPress 6.4.13 vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

Read the full analysis

Vulnerability Records

12 records


2026-10-28 00:00	WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution WordPress 6.4.13 4.7.0 – 7.1.3 · 25 branches	`N/A`	8.1 High	Umut Bayram	Yes
2026-09-17 00:00	WordPress Core <= 7.1 - Authenticated (Contributor+) Path Traversal via REST Templates Controller WordPress 6.4.13 5.8 – 7.1 · 6 branches	`N/A`	4.3 Medium	Anthropic	Yes
2026-09-17 00:00	WordPress Core <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data WordPress 6.4.13 6.6.7 – 7.1 · 6 branches	`N/A`	4.4 Medium	Jeremy Felt	Yes
2026-09-17 00:00	WordPress Core <= 7.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Overwrite WordPress 6.4.13 6.6.7 – 7.1 · 6 branches	`N/A`	4.3 Medium	Anthropic	Yes
2026-09-17 00:00	WordPress Core <= 7.1 - Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API WordPress 6.4.13 6.6.7 – 7.1 · 6 branches	`N/A`	4.3 Medium	viridis	Yes
2026-09-17 00:00	WordPress Core <= 7.1 - Authenticated (Contributor+) Information Exposure via Sample Permalink AJAX Actions WordPress 6.4.13 6.6.7 – 7.1 · 6 branches	`N/A`	4.3 Medium	hermanhms	Yes
2026-09-17 00:00	WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling WordPress 6.4.13 6.6.7 – 7.1 · 6 branches	`CVE-2026-93485`	7.2 High	Rafie Muhammad	Yes
2026-09-17 00:00	WordPress Core <= 7.1 - Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass) WordPress 6.4.13 6.6.7 – 7.1 · 6 branches	`N/A`	5.5 Medium	Ben Bidner	Yes
2026-09-17 00:00	WordPress Core <= 7.1 - Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite) WordPress 6.4.13 6.6.7 – 7.1 · 6 branches	`N/A`	2.7 Low	Jesse McNeil	Yes
2026-09-17 00:00	WordPress Core <= 7.1 - Forced Theme Install/Preview and Selector Injection via Theme Installer Route WordPress 6.4.13 6.6.7 – 7.1 · 6 branches	`N/A`	4.3 Medium	Paulos Yibelo	Yes

Showing 1–10 of 12 reports