WordPress 7.1.2 lands as a critical security release

WordPress 7.1.2 is out and it is a security release, which makes it urgent rather than routine for anyone running the current branch. The project is asking administrators to update immediately, and sites with automatic background updates enabled will patch themselves without anyone pressing anything.

The release carries a single fix, rated critical severity, and the summary of it is short enough to be alarming: an unauthenticated attacker can, under certain conditions, make page template resolution pull in a readable local PHP file from outside the active theme directories. Where the relevant pre-conditions for both the server environment and the active theme are in place, that can lead to remote code execution.

What the flaw actually does

The conditional language is doing real work here. Page template resolution is the mechanism that decides which theme file renders a given URL, and the bug lets a crafted request steer it towards a local PHP file it should never consider. Turning that into code execution needs the file to be both readable and useful to whoever chose it, which depends on how the host is configured and on the theme that happens to be installed. On a locked-down host with a well-built theme the practical risk is smaller than the severity rating suggests. On shared hosting with permissive permissions, it is not a risk worth scheduling for the weekend.

Backports down to 4.7

The security team credits Robert Ressl with reporting the issue. John Blackbourn led the release, with around two dozen contributors named in the announcement. Crediting the reporter and listing the contributors is standard practice here, and it is one of the reasons WordPress vulnerabilities get patched quickly rather than quietly.

The advisory is filed as CVE-2026-87902, with the public GitHub advisory tracked as GHSA-7hp8-65ch-5whp. Backports of the fix are being prepared for every branch still eligible for security updates, which currently reaches back as far as 4.7, and those releases will ship as they become ready. Only the most recent version of WordPress is actively supported, so an old branch that receives this one patch should not be read as an invitation to stay there.

The update is available from WordPress.org or through the dashboard, where it appears under Updates.

Our opinion

WordPress has trained its users to treat these announcements as background noise, and the reasoning is usually sound: most security releases fix something that needs an unusual set of circumstances. This one is a reminder of how much of the web sits on a single template resolver. The distance between a malformed request and somebody else running code on your server is normally a long chain, and this bug shortens it for sites whose hosting was configured years ago and never revisited.

The honest advice is also the dull advice. Turn on automatic updates for minor releases, check which PHP version your host is actually running, and stop treating an old branch as a safe place to wait. The patch is already written. Applying it is the only part that is still optional, and that is exactly the part that decides whether a critical advisory becomes an incident.