WordPress 7.1.2: A Critical Security Fix for Page Template Resolution

WordPress released version 7.1.2 on 22 September 2026 to fix a vulnerability classified as critical. The project recommends immediate updating and also provided fixes for older branches through 4.7. These backports do not mean all historical branches receive active support. [1]

What the advisory establishes

CVE-2026-87902 / GHSA-7hp8-65ch-5whp concerns page-template resolution. Under documented theme and server conditions, an unauthenticated request can cause a readable PHP file outside the theme directories to be included, potentially leading to remote code execution. The affected 7.1 versions are 7.1.0 and 7.1.1; the fix is 7.1.2. [2]

Remote code execution means that an attacker may cause the server to run code. “Conditional” matters: the advisory is not a statement that every installation has already been compromised. Equally, an uneventful homepage visit is no proof that an installation is patched.

A short operational check

The update procedure should start with a recoverable backup of files and database. The official update documentation describes dashboard and manual routes. [3] After installation, recording the actual version and checking representative pages provides clearer evidence than merely noting that automatic updates are enabled.

1. Record the installed version for each installation, including staging and less visible sites.
2. Apply the relevant official security release and record the outcome.
3. Check the homepage, an ordinary page, a post, login and an important form.
4. Review update failures separately instead of assuming every installation completed successfully.

What a checksum check can and cannot show

Where WP-CLI is available, the following read-only commands report the version and compare core files against published checksums. --include-root also warns about unexpected items in the root directory. [4]

wp core version
wp core verify-checksums --include-root

A checksum result is evidence about the files covered by that check. It is not a full investigation of plugins, themes, database content, accounts or earlier activity. Unexpected files need assessment rather than automatic deletion.

Editorial status: 27 September 2026. This report covers the release and its documented scope. It does not claim exploitation on a particular website or certify the security of an installation.