WordPress released 7.1.2 on 22 September 2026, a security release fixing a single critical-severity vulnerability. It arrived five days after 7.1.1, which itself carried 11 security fixes.
The Vulnerability
CVE-2026-87902 is a path traversal flaw in page template resolution. Under certain conditions, an unauthenticated visitor can make WordPress include a readable PHP file from outside the active theme’s directories. Where the server environment and the active theme both meet the preconditions, that becomes remote code execution.
WordPress rates it Critical, with a CVSS score of 9.2 out of 10. No login is needed, and no plugin is involved. The “certain conditions” are doing some work in that description, and the advisory does not spell them out, so we are treating every site as exposed until it is on the patched version.
It was reported responsibly by Robert Ressl. The advisory lists patched versions for every branch back to 4.7, including 7.0.6 and 6.9.9 for sites still on those lines. The release post notes the backports were still shipping as of 22 September, so older branches may lag 7.1.2 by a day or two.
7.1.1, Five Days Earlier
WordPress 7.1.1 went out on 17 September as a combined maintenance and security release: 17 bug fixes in core, 19 in the block editor, and 11 security fixes. The headline issue was a stored cross-site scripting flaw in wpautop(), the function that turns line breaks into paragraphs, reachable by an unauthenticated visitor through comments.
The other ten covered an authenticated path traversal in the REST templates controller, a Contributor-level arbitrary post overwrite, theme installation via crafted URLs, an XML-RPC publishing bypass, and several information disclosure issues.
The Pace Since 7.0
| Date | Release | What it was |
|---|---|---|
| 20 May | 7.0 | Major release |
| 9 July | 7.0.1 | Maintenance, 31 bug fixes |
| 17 July | 7.0.2 | Security: unauthenticated RCE chain in the REST API, forced auto-updates |
| 6 August | 7.0.3 | Security: 12 fixes |
| 12 August | 7.0.4 | Security: image-handling RCE |
| 19 August | 7.1 | Major release |
| 17 September | 7.1.1 | Maintenance and security: 11 fixes |
| 22 September | 7.1.2 | Security: 1 critical |
That is five core security releases in 67 days, and 27 core vulnerabilities fixed so far in 2026. Patchstack counted six in WordPress core across the whole of 2025. We covered 7.0.2 and 7.0.4 as they landed, and the 2025 figures in our post on vulnerability disclosures.
Two major releases shipped 13 weeks apart, and 7.2 is pencilled in for 10 December 2026. The credits on these releases repeat the same names: pwn.ai, Assetnote, Anthropic, Awesome Motive and the WordPress security team itself. Core is being examined more closely, and more often, than it was a year ago.
The practical effect for anyone running a WordPress site is that “core is stable, it’s the plugins you need to watch” no longer describes 2026. Core has needed attention roughly every two weeks since mid-July.
What Our Clients Need to Do
Nothing. 7.1.2 installs through WordPress’s automatic background updates. As with every core security release this year, we check each site we manage has actually landed on the new version rather than assuming the update ran, since auto-updates can be silently disabled by a config constant or a leftover version-control folder.
Sites we hold back on an older branch for compatibility reasons get the backport for that branch, and we confirm the same way once it ships.
Self-Managed Sites
Check Dashboard → Updates and confirm you are on 7.1.2. If you are on 7.0.x or 6.9.x, look for 7.0.6 or 6.9.9 respectively; if the update is not offered yet, the backport for your branch has not shipped and you should check again tomorrow.
While you are there, confirm core auto-updates are enabled. Five security releases in ten weeks means a site applying them by hand has spent a meaningful share of the summer running a version with a known, published flaw.
For a once-over on whether your site is patched and set up to stay that way, get in touch or see our managed WordPress care plans.
