WordPress 7.1.2 patches a critical file-inclusion flaw

WordPress shipped version 7.1.2 on September 22, 2026, a security-only release that patches a critical vulnerability tracked as CVE-2026-87902. The flaw sits in page-template resolution and can, under certain conditions, lead to remote code execution without authentication. The fix has been backported all the way to the 4.7 branch, and a working proof-of-concept is already public: updating is not optional.

#What 7.1.2 fixes

The bug lives in get_page_template(), the function responsible for resolving which template file to load for a given page. An unauthenticated attacker can manipulate the resolution parameters to make WordPress include a readable PHP file located outside the active theme’s directories. Depending on server configuration and the active theme, that local file inclusion can escalate to remote code execution.

The issue was reported by researcher Robert Ressl and documented as GHSA-7hp8-65ch-5whp. It carries a CVSS v3.1 score of 8.1 and a CVSS v4.0 score of 9.2 (critical), the gap reflecting how easily the flaw can be triggered without user interaction under the newer scoring model.

#An exploit already documented in public

Additional concern: a proof-of-concept repository detailing the attack surfaced almost at the same time as the patch, shortening the window between disclosure and real-world exploitation. Mail Studio is not relaying any exploit code or attack steps here; what matters for site administrators is update speed, not the technical mechanics of the attack.

Under certain server and active-theme conditions, the local file inclusion documented as CVE-2026-87902 can escalate to unauthenticated remote code execution.

#How to check and force the update

Most installations with automatic updates enabled have already switched in the background. Sites managed manually, or hosted where the provider disables automatic minor updates, need an explicit check.

# Check the installed version
wp core version

# Force the update to the latest minor release
wp core update

# Confirm afterwards
wp core version

Without WP-CLI access, the dashboard’s Updates screen shows the same prompt and applies the fix in one click. Restarting the object cache or a front proxy (Varnish, Cloudflare) after updating avoids re-serving a response generated by the vulnerable code.

Sites that expose poorly maintained third-party themes, or whose server configuration is permissive about reading PHP files outside the active directory, deserve a manual check even after updating: the patch addresses the root cause in core, but a minimal hardening baseline reduces the attack surface further, in particular on file permissions and per-directory PHP execution restrictions.

#For self-hosted sites

Installations managed through a panel like CloudPanel don’t always apply WordPress minor updates by default, unlike a managed shared-hosting setup. On this type of infrastructure, described in the guide on self-hosting WordPress with CloudPanel, the manual check described above is the only guarantee of fast coverage.

#Key takeaways

WordPress 7.1.2 fixes a critical local-file-inclusion flaw, exploitable without authentication under certain conditions, with a proof-of-concept already public. The fix reaches back to the 4.7 branch. The immediate priority is updating; hardening the server baseline remains the defense-in-depth that limits the impact of the next flaw in this family.

Further reading: the full security advisory is available on GitHub Security Advisories (GHSA-7hp8-65ch-5whp) and the official announcement on wordpress.org/news.