WordPress BLOG

WordPress 7.1.2: One Critical Fix, and Why It Beats Last Week’s Eleven

Published On: September 22nd, 2026By 5.4 min readViews: 50
WordPress 7.1.2 Update

Table of Contents

Share This Post

WordPress 7.1.2 was released on September 22, 2026. It fixes exactly one thing. That one thing is rated critical, and unlike most WordPress security fixes, an attacker does not need an account on your site to attempt it. Update today.

One Fix, and Why That Is Not Reassuring

Last month’s WordPress 7.1.1 contained eleven security fixes. This one contains a single fix. It is the more urgent of the two releases, and the reason is worth understanding.

Of the eleven issues patched in 7.1.1, ten required the attacker to already have a login on your website. That is a meaningful barrier. The single issue fixed in 7.1.2 has no such requirement.

In WordPress’s own words, an unauthenticated attacker can, under certain conditions, cause WordPress to load a PHP file from somewhere on the server that it was never meant to load. Where the server and the active theme line up in a particular way, that can lead to remote code execution, which means running the attacker’s code on your server.

The issue was reported by Robert Ressl and is tracked as CVE-2026-87902. You can read the full release announcement on WordPress.org.

What “Under Certain Conditions” Actually Means

WordPress is being precise rather than reassuring here. The vulnerability depends on specific pre-conditions in both your server configuration and your active theme. Not every WordPress site can be exploited this way.

The problem is that you almost certainly cannot tell whether your site meets those conditions. It depends on how your host has configured PHP, and on internal details of how your theme resolves templates. Those are not things visible from the WordPress dashboard.

So the practical reading is this: your site may not be exploitable, you have no straightforward way to find out, and the fix takes two minutes. That math is not difficult.

What You Should Do

Update today. Not this weekend. This is the category of flaw where automated tools are built quickly, precisely because no login is required, and they are pointed at every WordPress site on the internet rather than at anyone in particular.

  1. Check which version you are on. In your dashboard, go to Dashboard then Updates. It will tell you plainly.
  2. Back up first. Files and database. It takes a moment and it is the difference between an inconvenience and a bad afternoon.
  3. Update WordPress core. Dashboard, Updates, Update Now.
  4. Update your theme too. This flaw involves theme template handling, so a current theme matters more than usual here.
  5. Load your site afterward. Home page, a service page, your contact form. Sixty seconds of checking catches almost anything that went wrong.

Technical note: WordPress 7.1.2 requires PHP 7.4 or higher. Most current hosting comfortably exceeds this. If you are not sure what your host runs, we can check for you.

If You Are Still on an Older Version of WordPress

WordPress is backporting this fix to older release branches, going back as far as 4.7. If you are running an older version, a patch is coming for you too.

That is genuinely useful, and it is also a trap worth naming. A backport fixes this one flaw on your old version. It does not make that version supported, and it does nothing about everything else that has been fixed since. If your site is sitting several versions behind, the backport buys you time rather than solving the problem.

Should You Be Handling This Yourself?

Our answer has not changed since last month. If you are comfortable taking a backup, you know which plugins your site depends on, and you will actually check the site afterward, a release like this is well within reach.

What is worth noticing is the pattern. WordPress shipped 7.1.1 on September 17 and 7.1.2 on September 22. That is two security releases in five days, both requiring prompt action. Neither was difficult on its own. The difficulty is being the person who notices, every time, indefinitely.

If that is not a job you want, it is exactly what a WordPress maintenance service covers. If you would rather keep doing it yourself, pair it with a reliable backup routine and a couple of solid WordPress security plugins.

Frequently Asked Questions

Yes, and the count is misleading. What matters is not how many issues were fixed but what an attacker needs in order to use them. Last month’s release had eleven fixes, and ten of them required the attacker to already hold an account on your site. This one has a single fix that requires no account at all. Fewer fixes, lower barrier, higher urgency.

Yes. WordPress 7.1.2 is a separate release addressing a different issue that was not known when 7.1.1 shipped five days earlier. Two security releases in one week is unusual, but it is what happened, and 7.1.1 does not include this fix.

You generally cannot tell from the dashboard, and the absence of obvious symptoms does not mean much. If your site was running an affected version and is publicly reachable, the honest position is that you do not know. If you have specific reason for concern, such as unexpected administrator accounts, unfamiliar files, or your host contacting you, that warrants a proper look rather than guesswork.

It is unlikely. This is a targeted security release rather than a feature update, so it changes very little. The usual precautions still apply: back up first, and check your key pages afterward. If anything looks wrong, an outdated plugin or theme is almost always the cause rather than WordPress itself.

Yes. Our WordPress maintenance service covers core, plugin, and theme updates, with a backup before every change and a check afterward. Given that this is the second urgent WordPress release in five days, this is a reasonable moment to consider whether tracking them is a good use of your time. Get in touch and we will explain how it works.

Let jVista Handle Your WordPress Updates

Two urgent WordPress releases inside a single week is a fair illustration of why update management is a standing job rather than an occasional chore. At jVista Website Services, we manage WordPress updates for Tucson businesses so that releases like this one are handled before you have heard of them.

Our WordPress maintenance plans include:

  • Core, plugin, and theme updates tested before they are applied
  • Daily backups with one-click restore
  • Security monitoring and malware scanning
  • Uptime monitoring with instant alerts
  • Priority support when something needs a human

Wondering whether a maintenance plan is worth it for a site your size? Read our honest take on when it is and is not, or get a free maintenance quote.

Share This Post

More Reading

Need Help Putting This Article Into Action?

Reading about it is one thing, implementing it while running a business is another. If you'd rather hand this off to a team that's been doing it for over 20 years, we're happy to help. No pressure, no long-term contracts. Just a straightforward conversation about what your site needs and whether we're the right fit.