WordPress 7.1.2 was released September 22, 2026 as a security release for a critical vulnerability. WordPress says an unauthenticated attacker can, under certain conditions, make page-template resolution include a chosen readable local PHP file outside the active theme directories; when the required server-environment and active-theme preconditions are both present, this can lead to remote code execution. WordPress recommends updating immediately. Treat the response as patch-and-verify work: update the WordPress Core branch you actually run, confirm the running production version, test theme/template behavior and critical site journeys, and review logs for credible signs of compromise without trying to reproduce the exploit on a live site.
Your WordPress dashboard offers the 7.1.2 security release
A scanner or security notice flags CVE-2026-87902 / GHSA-7hp8-65ch-5whp
A site is still on WordPress 7.1.1 or another older branch after September 22, 2026
You need to know whether the update is routine maintenance or an urgent security response
Possible causes
WordPress Core page-template resolution could include a chosen readable local PHP file outside the active theme directories under specific conditions
The vulnerability is reachable by an unauthenticated attacker when relevant server-environment and active-theme preconditions are present
Including a local PHP file under those conditions can lead to remote code execution
The WordPress security team released 7.1.2 and is backporting the fix to branches eligible for security updates
HOW TO FIX IT
Work from the safest step to the harder repair.
Step 1. Record the exact WordPress Core version running in production before making changes. Check the Dashboard, deployment artifact or hosting control plane rather than assuming a repository or staging version matches production.
Step 2. Update WordPress Core immediately through the site's normal trusted update process. WordPress specifically recommends immediate updating for 7.1.2 because this release fixes a critical-severity security vulnerability.
Step 3. If the site runs an older WordPress branch, use the appropriate security backport for that branch once available. WordPress says the fix is being backported to branches eligible to receive security fixes, currently through 4.7, while only the most recent WordPress version is actively supported.
Step 4. Do not change themes, template paths or server permissions merely to test whether the vulnerable behavior can be triggered. Patch first; reproduction of an RCE path on production can create additional risk and is unnecessary for routine remediation.
Step 5. After updating, verify the actual running Core version from the production environment and clear only the caches needed by the site's normal release process. A successful package download or dashboard message is not proof that every production instance is updated.
Step 6. Exercise page templates, custom post-type templates, theme rendering, login, forms, checkout or other critical site journeys that matter to the application. The vulnerability involves template resolution, so a broken custom template after patching should be treated as a compatibility issue to fix—not a reason to roll the security patch back without a risk decision.
Step 7. Review recent web-server, PHP, application and security logs for unusual template/path requests, unexpected PHP execution, newly created administrator accounts, modified Core/theme/plugin files or other credible compromise indicators. Keep this defensive and evidence-led; do not publish or replay exploit payloads.
Step 8. If compromise is suspected, move from normal patching to incident response: isolate affected systems where appropriate, preserve logs, rotate credentials and secrets that may have been exposed, verify clean backups, inspect persistence mechanisms and rebuild from trusted artifacts when required.
Step 9. Check automatic-update behavior across the fleet. WordPress says sites supporting automatic background updates will begin the update process automatically, but administrators should still verify completion rather than assuming every site succeeded.
Step 10. Document the patched version, verification time, test results and rollback/recovery plan. Keep the previous 7.1.1 guide as historical context for that earlier release; do not treat it as evidence that the September 22 critical issue is already fixed.
Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.
Patch WordPress Core from an authorized source and preserve a tested backup or recovery point before production changes.
Keep logs, backups and incident artifacts private because they can contain credentials, paths, personal data or other sensitive information.
Use authorized security validation only and verify production version/state without attempting to weaponize or reproduce the RCE.
STOP AND GET HELP WHEN
Do not turn a repair into a larger outage.
Do not publish exploit instructions, payloads or a production reproduction procedure for the RCE path.
Do not claim every WordPress installation is exploitable in exactly the same way; WordPress says exploitation depends on relevant server-environment and active-theme preconditions.
Do not assume WordPress 7.1.1 fixes the September 22 critical issue; 7.1.2 is the current security release for this vulnerability.
Do not roll back the security update solely because a custom theme or template breaks; fix the compatibility problem or make a documented risk decision with a secure alternative.
HOW GENESIS HANDLES IT
Diagnose the exact failure before choosing a repair.
Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.
Platform scope
WordPress Core sites, themes, managed WordPress hosting and self-hosted WordPress production environments
Category
WordPress · Critical security release
Last updated
2026-09-22
REPAIR PROFILE
Know the complexity before you edit.
Difficulty
Intermediate
Change risk
High
These labels describe implementation complexity and blast radius, not a guaranteed repair time.
AUTHORITATIVE SOURCES
Verify time-sensitive platform details at the source.
WordPress says 7.1.2 fixes a critical vulnerability where an unauthenticated attacker can, under certain conditions, cause page-template resolution to include a chosen readable local PHP file outside the active theme directories, potentially leading to remote code execution when the required preconditions are present.
Should I update WordPress 7.1.2 immediately?
Yes. WordPress explicitly recommends immediate updating because 7.1.2 is a security release for a critical-severity vulnerability.
Is the fix available for older WordPress branches?
WordPress says the security fix is being backported to branches eligible to receive security fixes, currently through 4.7, and that the backports will ship as they become ready. Verify the current release for the branch you actually run.
Do I need to reproduce the vulnerability to know the patch worked?
No. For normal remediation, verify the patched Core version and critical site behavior. Attempting to reproduce remote code execution on production adds risk and is not necessary to confirm that the deployed version contains the official fix.
Once you know the platform and the verified problem, search the Genesis Code Doctor Code Store for a matching package. If the exact integration or repair is not there, use Request a Code and describe the platform, official documentation, desired behavior, and sanitized error—never send your secret key.
Start with a free diagnostic. If Genesis verifies a problem and a compatible treatment exists, continue to the matching Code Store product or repair path. If you cannot find the exact code you need, request it at GenesisCodeDoctor.com rather than forcing a generic snippet into the wrong platform.
GENESISCODE DOCTOR AI