WordPress 7.1.2 Release
WordPress 7.1.2 patches critical unauthenticated local file inclusion that can lead to remote code execution.
WordPress 7.1.2 fixes CVE-2026-87902, a critical flaw disclosed by Robert Ressl. Under certain server and theme conditions, an unauthenticated attacker can make page template resolution include a chosen readable local PHP file outside the active theme, potentially leading to remote code execution. The fix is being backported to security-supported branches through WordPress 4.7. Sites should update immediately; automatic background updates will apply where enabled.
- CVE-2026-87902 can become RCE if server and theme preconditions are met
- Unauthenticated attackers can include a local PHP file outside the theme
- Fix backported to branches still eligible for security updates, through 4.7
- Only the latest WordPress version is actively supported
- CVEs
- CVE-2026-87902
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
From the original article
1 min read at wordpress.org
This security release features a fix for a critical severity security vulnerability. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.
By John Blackbourn · wordpress.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.