WordPress 7.1.2 plugs critical RCE: update immediately

WordPress released version 7.1.2 on 22 September 2026, a security update addressing a critical unauthenticated path traversal vulnerability. For anyone running WordPress instances in production on shared hosting or VPS, this is a patch to apply immediately, not queue for later.

What 7.1.2 fixes

The flaw, tracked as CVE-2026-87902, affects the get_page_template() function used in page template resolution. An attacker can cause get_page_template() to include an arbitrary readable local PHP file outside the active theme directory; remote code execution becomes possible when additional theme and server prerequisites are met. The assigned score is CVSS v4.0 9.2, critical.

One of the documented exploit chains goes through PEAR: the attacker uses /usr/local/lib/php/pearcmd.php, and WordPress notes that this escalation path can work when register_argc_argv=On, including in affected official PHP Docker environments.

Who is exposed

Not all installations face equal risk. Servers using the official PHP Docker image, default cPanel configurations with PHP prior to 8.5, and themes with a top-level directory name beginning with "page-" are at greater risk. Themes mentioned include Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney.

On the version front, the bug affects WordPress from 4.7.0 through 7.1.1 across all corresponding maintained branches, and WordPress has released patched releases down to the 4.7 branch. For those unable to upgrade to 7.1 yet, a backport is available for your minor branch.

Context: the 7.1 "Mary Lou" release

7.1.2 arrives a month after the major release. WordPress 7.1 "Mary Lou" was released during WordCamp US 2026, dedicated to jazz pianist Mary Lou Williams, featuring responsive styles, client-side media editing, notes with mentions, a persistent admin bar, and new blocks. On infrastructure requirements, the CMS officially declares support from PHP 7.4 onwards, but in practice remains operational on older versions so long as the server provides them.

What to do

Check the active version from the dashboard, update to 7.1.2 (or the corresponding patched minor release on your branch), verify whether your theme has a folder beginning with "page-", and if running cPanel, check your installed PHP version. A full backup before updating remains standard practice.