WordPress 7.1.2: A Critical Security Fix for Page Template Resolution

WordPress 7.1.2 was released on 22 September 2026 to fix a critical vulnerability in loading page templates. Under specific conditions, a request without signing in could cause code to run on the server. The update therefore mattered even for websites with an apparently normal homepage. [1]

Context as of 25 October 2026: This article covers the fix in 7.1.2. Version 7.1.3 followed on 6 October with further security fixes. A planned update should therefore target the current official version, not just the version discussed here. [5]

What the vulnerability allows

A theme controls the appearance of a WordPress site. When loading a page template, WordPress could include an existing PHP file outside the theme folders under the conditions described in the advisory. PHP code runs on the server. Loading the wrong file could therefore lead to code execution without a signed-in account. The advisory identifiers are CVE-2026-87902 and GHSA-7hp8-65ch-5whp. [2]

The described attack required several conditions together: a particular folder structure in the active theme and a suitable existing PHP file accessible to the web server. The advisory does not establish that every website was attacked. Conversely, a functioning homepage does not establish protection. In the 7.1 branch, versions 7.1.0 and 7.1.1 were affected; 7.1.2 contained the fix.

What to check after updating

Before updating, a backup of files and the database must support restoring the website. The official instructions cover updates through the administration area and manual file replacement. [3] Four checks follow:

1. Record the actual installed version of each website, including test systems and rarely visited installations.
2. Confirm successful installation of the current official version. An enabled update setting alone does not prove completion.
3. Test the homepage, an ordinary page, a post, sign-in and an important form.
4. Address errors and failed updates individually.

What checksums reveal

WP-CLI manages WordPress from the command line. The following commands run inside the directory of the intended WordPress installation. The first displays the installed version. The second compares WordPress core files with checksums published by WordPress.org. A checksum is a comparison value calculated from file contents. A mismatch means a checked file differs from the reference. [4]

wp core version
wp core verify-checksums --include-root

--include-root also reports unexpected files and folders in the root directory. An incorrect language or version selection can produce mismatches even for unchanged files; --locale and --version control those selections. The command downloads checksums from WordPress.org without changing the checked core files. Matching an old version does not make that version current.

This check does not investigate the whole database, user accounts or past attacks. Legitimate additional files can also trigger warnings. Before deletion, the file’s origin and purpose need establishing. A checksum match is not a comprehensive security assessment.