WordPress introduced version 7.1.2 on September 22, 2026, just five days after the last release. A critical security bug in the previous version drove this new release. WordPress website users shouldn’t postpone this update, since an attacker can exploit this vulnerability without even logging into the website.
Quick Answer
WordPress 7.1.2 is important because it contains a security fix for a local file inclusion bug that can result in remote code execution. This vulnerability is assigned the identifier CVE-2026-87902 and receives a 9.2 CVSS score. It affects all versions of WordPress from 4.7 to 7.1.1, including version 7.1.1.
What Happened in WordPress 7.1.2?
WordPress decides which theme file to load for a specific page, it checks multiple filenames. WordPress built one of these filenames from part of the page’s web address, and that particular check skipped a security measure the adjacent check included.
In practical terms, this let a remote attacker request a maliciously crafted URL and trick WordPress into loading a file it shouldn’t load, without needing any account on the website.
Robert Ressl responsibly reported the bug to the developers, and it carries the identifier CVE-2026-87902, with a CVSS 4.0 critical severity rating of 9.2/10.
Why This Vulnerability Is Serious
The fact that an attacker can force WordPress to load an unwanted file is already a risk on its own, but it gets riskier still: under certain circumstances, that same flaw can run custom code and hand an attacker full control of the website.
Two things need to line up for that worst case to happen:
- The active theme has a folder whose name starts with “page-” (for example, “page-templates”). Older default themes like Twenty Twelve and Twenty Fourteen have this, along with some popular third-party themes.
- The server’s PHP configuration allows a specific PHP setting called
register_argc_argv, which is turned on by default in some common hosting setups, including certain cPanel configurations running PHP versions older than 8.5.
Even if your site doesn’t meet both conditions, the underlying file-loading flaw is still present until you update. Themes and server settings can change over time, so updating is the only complete fix.
Which WordPress Versions Are Affected?
This is an unusually wide-reaching patch. Every WordPress release from version 4.7 up through 7.1.1 is affected, close to a decade of releases.
That includes sites that updated to 7.1.1 just five days earlier; that version does not protect against this issue.
WordPress has also released fixed versions for every older branch it still supports, including:
| WordPress Branch | Fixed Version |
|---|---|
| 7.1.x | 7.1.2 |
| 7.0.x | 7.0.6 |
| 6.9.x | 6.9.9 |
| 6.8.x | 6.8.10 |
| 6.7.x | 6.7.9 |
| 6.6.x | 6.6.9 |
| 6.5.x | 6.5.12 |
| 6.4.x and earlier, down to 4.7.x | Corresponding patched version released |
WordPress 4.6 and earlier no longer receive security updates and should be upgraded to a supported version rather than patched.
How WordPress Fixed the Issue
Two changes have been released for this issue. One change is specific to the reported problem and puts the same file safety check into the area where it was missing.
The other change is broader: WordPress will now run every resolved template file through an additional check to make sure it exists inside an allowed theme directory, no matter how the code generated that file path.
Only one file was changed in this release: wp-includes/template.php. No plugins or other packages required updates.
Is Your Site Affected? How to Check
Since WordPress can update automatically within the same version branch in many cases, it’s worth confirming your specific version:
- Log in to your WordPress admin dashboard.
- Check your version number in the bottom-right corner of any admin page, or go to Dashboard → Updates.
- If you are not already on 7.1.2 (or the latest patched version of your branch), update immediately.
Generally, WordPress carries out automatic background upgrades within the same branch: a website on 7.1.1 will automatically upgrade to 7.1.2, while a website running 7.0.5 will only upgrade to 7.0.6, not 7.1.2.
How to Update to WordPress 7.1.2
- Back up your site before updating, as a general precaution.
- Log in to your WordPress admin area.
- Go to Dashboard → Updates.
- Click Update Now if 7.1.2 (or your branch’s patched version) is available.
- Confirm the update completed by checking your version number again.
If you can’t update immediately, two quick checks tell you how exposed you are in the meantime: look at whether your active theme has a folder starting with “page-“, and check with your host whether register_argc_argv is enabled on your PHP configuration. Neither of these is a substitute for updating, but they help you gauge urgency.
Common Mistakes to Avoid
- Assuming last week’s update covers this. If you are updated to 7.1.1 recently, you are still affected and need to update again to 7.1.2.
- Relying only on automatic updates without checking. Branch-limited auto-updates can leave you on an older branch’s patched version instead of the current release.
- Ignoring the update because your theme “looks fine.” The underlying flaw exists in WordPress core regardless of theme, even if the worst-case outcome depends on theme and server conditions.
FAQs
What is WordPress 7.1.2?
Released on September 22, 2026, WordPress 7.1.2 is a security patch that addresses one critical vulnerability in WordPress software releases from 4.7 to 7.1.1.
Is WordPress 7.1.2 a critical update?
Yes. It fixes a flaw rated at 9.2 on the CVSS scale of 10. WordPress advises installing the update right away.
Does WordPress 7.1.1 protect against this vulnerability?
No. WordPress 7.1.1, launched five days earlier, is also vulnerable. Only version 7.1.2 or later solves this problem.
Can this vulnerability be exploited without a login?
Yes, because the vulnerability doesn’t require authentication, meaning the attacker doesn’t need to log into any account to exploit it.
What is CVE-2026-87902?
This is the official vulnerability ID for the problem, related to an unauthenticated local file inclusion vulnerability in WordPress’s page template handling, which can potentially result in remote code execution.
Do I need to change my theme because of this vulnerability?
Not necessarily. Updating WordPress to the patched version resolves the core issue. Certain themes with a “page-“-prefixed folder increase the risk if you remain unpatched, but the fix applies regardless of theme.
Conclusion
WordPress 7.1.2 addresses one of the more serious vulnerabilities the platform has patched recently, reaching back across nearly a decade of releases and requiring no attacker login to attempt. The fix itself takes only a few minutes to apply from the WordPress dashboard, and given the vulnerability’s severity score and unauthenticated nature, updating promptly is the safest move for any WordPress site owner.
For more WordPress and tech updates, check out our blog category.
Visit Our Recommended Websites
Here are our trusted partners and resources for your requirements:
