The WordPress 7.1.2 security update, released on 22 September 2026, fixes a critical flaw (CVE-2026-87902) that lets an attacker who is not logged in trick WordPress into loading a PHP file it should never touch. On some servers that becomes full remote code execution. Attackers began probing for it within hours of the release, so every WordPress site from 4.7 onwards needs to be on a patched version now.
Most WordPress minor releases are quiet. This one is not. WordPress 7.1.2 contains a single fix, but the core team rated it critical, and security firm Patchstack saw the first attack attempts on the same day the patch went out.
The good news: if your site takes automatic minor updates (most do), it has probably patched itself already. The bad news: “probably” is not good enough when the attack needs no login. Below we cover what the bug is, how to confirm your site is safe in under two minutes, and what to check if you were slow to update.
What the WordPress 7.1.2 security update fixes
The bug lives in how WordPress picks a page template. According to the official advisory, an unauthenticated attacker can make the get_page_template() function include “a chosen readable local .php file outside the active theme directories.” In plain English: a crafted URL can make WordPress run a PHP file from somewhere else on the server.
The only file changed in the release is /wp-includes/template.php. The advisory scores it 9.2 out of 10 (CVSS v4), and it was reported by researcher Robert Ressl.
| Detail | What it means for you |
|---|---|
| Release date | 22 September 2026 |
| CVE | CVE-2026-87902 (GitHub advisory GHSA-7hp8-65ch-5whp) |
| Severity | Critical, CVSS v4 score 9.2 |
| Login needed? | No. Anyone on the internet can send the request. |
| Affected versions | WordPress 4.7.0 up to 7.1.1 |
| Fixed in | 7.1.2, plus backports such as 7.0.6, 6.9.9, 6.8.10, 6.7.9 and 6.6.9, all the way down to 4.7.37 |
| Files changed | wp-includes/template.php only |
WordPress 4.6 and older did not get a fix. If a client site is still that old, it needs a proper upgrade, not a patch.
Why this one is being taken seriously
A path traversal bug on its own is bad. What pushed this one to critical is the route to remote code execution (RCE), which means an attacker running their own commands on your server.
Patchstack’s write-up lists three conditions for the full RCE chain:
- A theme with a top-level “page-” folderFor example a folder called
page-templatesin the active theme’s root. - PHP with
register_argc_argvswitched onThis lets a query string be passed into the included script. PHP’s built-in default is on, and the setting is deprecated as of PHP 8.5. - A valid page ID on your siteTrivial to find on almost any WordPress site.
Even without all three, the traversal still works. Do not use “my theme has no page- folder” as a reason to skip the update.
The real-world attacks lean on pearcmd.php, a PEAR tool that ships with many PHP installs. Patchstack describes attackers first testing with harmless core files, then calling pearcmd with config-show, then switching to config-create to write a PHP file into /tmp or /var/tmp.
By 23 September a public scanning template was available, and Patchstack wrote that the exploit “is in general circulation and anyone can point it at a host list.” BleepingComputer and TechRepublic both reported active exploitation. Treat any unpatched site as a target.
How to check your site is on a patched version
This takes less time than reading this section. Do it for every WordPress site you look after.
- Log in to wp-admin and go to Dashboard > Updates.
- Look at the line under “WordPress Updates”. If it says you have the latest version and shows 7.1.2 (or a later 7.1.x), you are patched.
- If you see an Update to version 7.1.2 button, take a backup first, then click it.
- Still on an older branch on purpose (say 6.9)? Check you are on that branch’s patched number from the table above, for example 6.9.9.
- For a second opinion, open Tools > Site Health > Info, expand WordPress and read the Version row.
Managing a lot of sites? If you have shell access, wp core version from WP-CLI prints the version in a second. Run it across your client folders and anything below the patched number jumps out.
Why some sites did not update themselves
WordPress turns on automatic minor-release updates by default, so a stock install should have pulled 7.1.2 on its own. When a site misses a minor update, the cause is usually one of these:
WP_AUTO_UPDATE_COREset tofalseinwp-config.php, orAUTOMATIC_UPDATER_DISABLEDset totrue.- A host or management tool that switched off core updates so it could “handle them”, then did not.
- WP-Cron not running, often because the site gets little traffic or
DISABLE_WP_CRONis set without a real server cron job. - File permissions that stop WordPress writing to its own core files.
If one of these applies, fix it after you patch. Setting WP_AUTO_UPDATE_CORE to 'minor' keeps security releases automatic while leaving major upgrades for you to test.
Updated late? Check for signs of an attack
If your site sat on 7.1.1 or older for a few days after 22 September, a quick log check is worth it. Patchstack published these indicators:
| Look for | Where |
|---|---|
A pagename parameter containing %2e%2e or %252e%252e |
Web server access logs |
pagename and page_id together on the site root, e.g. /?page_id=12&pagename=templates%2f... |
Access logs |
The words pearcmd, +config-show or +config-create |
Access logs |
User agents cve-2026-87902-poc/1.0 or nuclei-cve-2026-87902/1.0 |
Access logs |
Unexpected PHP files such as wp-pear-rce-flag.php or poc87902.php |
/tmp and /var/tmp on the server |
On cPanel hosting, the raw access logs are under Metrics > Raw Access. Download the log for the domain and search it for pagename and pearcmd. On shared hosting you usually cannot see the server’s /tmp folder, so ask your host to check it for you.
Seeing probe requests in the log does not mean you were hacked. Scanners hit everything. What matters is whether a later request succeeded and whether any unexpected PHP file appeared. If you find one, change all admin and hosting passwords, rotate the salts in wp-config.php, and get the host involved.
Can’t update right away? Stopgaps
Sometimes a site is pinned to an old version because of a fragile plugin. Patching is still the only real fix, but these two steps cut the risk while you sort it out:
- Turn off
register_argc_argv. Patchstack lists this as a mitigation. On most cPanel hosts you can set it in MultiPHP INI Editor or aphp.ini/.user.inifile asregister_argc_argv = Off. PHP’s own documentation recommends switching it off anyway. - Block traversal in the
pagenameparameter at your firewall. If the site runs through Cloudflare, a WAF custom rule that blocks requests whose query string containspagenametogether with%2e%2eor%252eis a reasonable stopgap. If Cloudflare is new to you, our guide to fixing Cloudflare SSL redirect loops walks through the dashboard basics.
After updating, clear any page cache and CDN cache so visitors get pages built by the patched core. If your pages look odd afterwards, our post on clearing Elementor and page caches in the right order covers each layer.
The WordPress 7.1.2 security update fixes a critical, unauthenticated flaw that attackers began targeting on release day. Check Dashboard > Updates on every site, make sure you are on 7.1.2 or your branch’s patched number, find out why any site did not update itself, and scan your logs if you patched late.
Frequently asked questions
Does WordPress 7.1.2 install automatically?
On most sites, yes. WordPress applies minor and security releases in the background by default. It will not if automatic updates are disabled in wp-config.php, blocked by your host, or WP-Cron is not running, so always confirm the version in Dashboard > Updates.
Is my site affected if I use Hello Elementor or another popular theme?
Every WordPress version from 4.7.0 to 7.1.1 has the vulnerable code, whatever the theme. The theme only affects whether the full code-execution chain works. Update regardless.
Will the 7.1.2 update break my plugins?
It changes one core file, wp-includes/template.php, and no bundled packages. Breakage is unlikely, but take a backup before any manual update.
I’m on WordPress 6.8. Do I have to jump to 7.1?
No. The fix was backported, so updating to 6.8.10 closes this hole. Only the newest version is actively supported though, so plan the move to 7.1 soon.
Sources: WordPress.org: WordPress 7.1.2 Release; WordPress.org: Version 7.1.2 release notes; GitHub security advisory GHSA-7hp8-65ch-5whp; Patchstack: attackers started probing hours after the patch; BleepingComputer; WordPress Advanced Administration: Upgrading; PHP manual: register_argc_argv. Checked October 2026.
More in Software & Tools
Cloudflare SSL Modes Explained: Which One to Use
Cloudflare SSL modes control the link between Cloudflare and your server. See what Flexible, Full and Full (strict) do and which one fits your host.
Shopify Automated Policies: What Changed and What to Check
Shopify can now write and update your store policies for you. See what changed on 8 October 2026, who it affects, and what to check before you switch it on.
WordPress 7.1.3 Security Update: What to Check Now
WordPress 7.1.3 fixes 7 security issues and 4 bugs. See who is affected, how to update safely, and the cache cleanup the update does not do for you.