WordPress 7.1.2 Fixes a Critical Security Flaw: What Businesses Should Do Now

If your business website runs WordPress, check its version today. WordPress 7.1.2 was released on 22 September 2026 to fix a critical security vulnerability in WordPress core. The official advice is to update immediately.

The flaw is tracked as CVE-2026-87902 and has a critical CVSS score of 9.2. Under the right conditions, an attacker who is not logged in could make WordPress load a local PHP file outside the active theme directories. That can lead to remote code execution: the attacker may be able to run code on the server that hosts the website.

This does not mean every WordPress site has already been compromised, and the attack depends on specific theme and server conditions. It does mean waiting is a poor trade. The update is available, the potential impact is serious and no account is required to attempt the attack.

Here is what the update fixes, how to check your website and how to install it safely.

What does WordPress 7.1.2 fix?

WordPress published WordPress 7.1.2 as a dedicated security release. It fixes a path traversal issue in the way WordPress resolves page templates.

In ordinary language, a carefully constructed request could make a vulnerable WordPress installation look beyond the theme folder it was meant to use. If the server contained a suitable readable PHP file, WordPress could include that file and execute it. The official WordPress security advisory rates the issue as critical because an attacker can reach it over the network without signing in or persuading an administrator to click anything.

Remote code execution is serious because the website application runs with access to more than the page a visitor can see. Depending on the hosting setup, successful exploitation could expose website data, allow pages or files to be changed, create a route back into the system or use the site to redirect and mislead customers. The precise impact varies with permissions and server isolation, but it can affect confidentiality, integrity and availability at the same time. That is why the severity is based on possible technical impact as well as how many sites are likely to meet every prerequisite.

The attack is conditional. The active parent or child theme needs a top-level directory whose name starts with page-, such as page-templates. A suitable local PHP file must also be readable, and server configuration affects whether the full attack path works. WordPress lists legacy default themes and several third-party themes as examples where the directory condition may exist.

Conditional does not mean harmless. A critical, unauthenticated server-side vulnerability should be patched before somebody has time to test whether your particular setup is exploitable.

The French national cyber security agency CERT-FR also lists arbitrary code execution as the risk and directs administrators to apply the vendor update in its security notice.

Which WordPress versions are affected?

The advisory covers supported security branches from WordPress 4.7 through WordPress 7.1.1. The patched releases are:

• WordPress 7.1: update to 7.1.2.
• WordPress 7.0: update to 7.0.6.
• WordPress 6.9: update to 6.9.9.
• WordPress 6.8: update to 6.8.10.
• Older maintained branches: install the matching security release listed in the official advisory.

The best long-term choice is the latest stable WordPress release, currently 7.1.2 at the time of publication. WordPress backported the fix to older branches so organisations have an immediate patch, but WordPress says only the latest major release is actively supported. A backport buys time; it should not become a reason to leave an ageing installation untouched.

Sites on WordPress 4.6 or earlier are outside the range receiving this fix and have missed years of later security and compatibility work. Those sites need a planned upgrade, with staging and regression testing if the jump is large.

How to check your WordPress version

Sign in to WordPress and open Dashboard > Updates. That screen shows the installed core version and whether an update is available. The dashboard footer may also show the version, although a security plugin or custom administration theme can hide it.

If you manage the site through a hosting control panel, check its WordPress management screen as well. Developers with command-line access can run:

wp core version

Do not assume the update has landed because automatic updates are enabled. WordPress says most sites receive minor and security releases automatically, but a failed scheduled task, disabled file updates, unusual permissions or a managed deployment workflow can prevent that. Verify the version actually installed.

For Composer-managed WordPress projects, check both the live application and the dependency lock file. Updating the live files alone may allow a later deployment to restore the vulnerable version. The patched core version needs to be part of the reproducible build.

How to update WordPress safely

A security update should move quickly, but it should still be controlled. The following sequence keeps the work short and gives you a route back if something unrelated fails.

1. Confirm you have a restorable backup. Back up both the database and website files. A backup is useful only if somebody knows where it is, how recent it is and how to restore it.
2. Record the current state. Note the WordPress, theme and plugin versions. On a complex or revenue-critical site, take a quick staging copy or snapshot before changing production.
3. Install the official update. Use Dashboard > Updates, your trusted managed-host workflow, WP-CLI or the project’s normal Composer deployment. Do not download replacement core files from an unofficial website.
4. Clear relevant caches. Purge the application, object, page and edge caches used by the site so tests reach the updated application.
5. Test the journeys that matter. Check the homepage, important landing pages, contact and booking forms, administrator login, search and any customer account. For ecommerce, test the basket and checkout. For a headless site, verify the content API and frontend build.
6. Confirm the final version. Return to Dashboard > Updates or run wp core version. Confirm the expected release is active on every production instance.

The official WordPress update guide recommends backing up before an update and provides one-click and manual instructions. If your site has no reliable backup or nobody knows how it was deployed, pause only long enough to establish a safe recovery point, then patch it.

What should you test after the update?

WordPress 7.1.2 is a focused core security release, so the update itself should be low risk for a maintained site. Your test should still follow real business outcomes rather than stop at “the homepage loads”.

• Submit each important form and confirm the message reaches the correct inbox or CRM.
• Open key pages on a phone and desktop, including pages built with custom templates.
• Sign in and complete common editorial tasks in the WordPress dashboard.
• Check payment, booking, membership or account flows from beginning to end.
• Confirm scheduled jobs, transactional email and third-party integrations still run.
• Review monitoring and server logs for new errors after deployment.

If a test fails, capture the exact page, time and action. That evidence helps a developer separate an application problem from a cache, browser or third-party service issue. Avoid rolling back to the vulnerable release and leaving it there without a containment plan.

Does updating remove an existing compromise?

No. Updating closes the known flaw, but it does not prove that a website is clean. If an attacker already added a file, administrator account, scheduled task or another form of persistence, installing WordPress 7.1.2 will not necessarily remove it.

Warning signs include unexplained administrator users, changed files, unfamiliar plugins, unexpected redirects, search results for pages you did not create, outbound email spikes or alerts from your host or security monitoring. A quiet site is reassuring, but absence of an obvious symptom is not a forensic conclusion.

If you suspect a compromise:

• Record what you observed, when it happened and any changes already made.
• Preserve a snapshot of the current files, database and relevant logs before cleaning.
• Ask the host or an experienced WordPress security professional to inspect users, files, scheduled tasks, configuration and access logs.
• Remove malicious changes or restore from a known-clean backup, then patch every component before returning the site to service.
• Rotate administrator, hosting, database, file-transfer, server-access and API credentials once the environment is understood and clean.

WordPress’s own hacked-site guidance recommends documenting the incident, preserving a backup even if it may be infected, scanning the site and removing the compromise. For a site that holds personal data or processes payments, incident handling may also involve contractual, regulatory and customer-notification duties. Get appropriate legal or compliance advice for your organisation and location.

How to reduce the next WordPress security scramble

A website maintenance plan should make a security release routine. Someone owns the alert, confirms the backup, deploys the patch, tests important journeys and records the result. Monitoring then catches failures and suspicious changes early.

WordPress’s hardening guidance recommends keeping WordPress current, maintaining reliable backups, monitoring logs and removing plugins that are no longer used. Those basics matter more than installing a long list of security products without anyone reviewing their alerts.

A practical maintenance baseline includes:

• prompt core, plugin and theme updates from trusted sources;
• automated off-site backups with periodic restore tests;
• uptime, error and security monitoring with a named recipient;
• multi-factor authentication and individual administrator accounts;
• the smallest useful set of maintained plugins and themes;
• a staging or controlled deployment path for business-critical changes; and
• a short incident plan with hosting and development contacts.

This approach applies whether the site serves customers in Belfast, Dublin, London, New York or anywhere else. The vulnerability is global, and the sensible response is the same: verify, patch, test and monitor.

What to do today

Check the WordPress version on every site your organisation owns. If it is on the 7.1 branch, install 7.1.2. If it must remain on an older maintained branch temporarily, install the corresponding patched release from the official advisory and schedule the wider upgrade. Confirm the result instead of relying on the automatic-update setting.

If the site cannot be updated cleanly, has no dependable backup or shows signs of compromise, treat that as an operational issue rather than postponing it indefinitely. Establish a recovery point, bring in the right technical help and close the exposure.

Release and advisory details checked on 28 September 2026. WordPress security guidance can change as investigations continue.

Pixolite provides WordPress maintenance and support, security updates and recovery help for businesses in the UK, Ireland, the United States and internationally. If you need somebody to verify the update or take ownership of an ageing website, book a direct call with Damian.