WordPress 7.1.2 Release  🔗 **Source:** [WordPress 7.1.2 Release](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/) > [!note]+ Document Notes > --- > tags: [wordpress-security, rce, responsible-disclosure, lfi, core-updates] > author: WordPress.org > source: WordPress.org News > reference: https://wordpress.org/news/2026/09/wordpress-7-1-2-release/ > date created: 2026-09-22 07:22 > --- > > [!info] Generated analysis — not the author's words. Sections below are machine-written > > from the captured source. Only text inside `> [!quote]` blocks is verbatim from the author. > > Do not quote or attribute any other line to the named author. > # 🏷️ Title: WordPress 7.1.2 Release > ## 🧭 Table of Contents > - [📝 Summary](#-summary) > - [📖 Main Content](#-main-content) > - [🗒️ Notes](#️-notes) > - [📚 References](#-references) > - [🗣️ Paraphrase](#️-paraphrase) > - [📰 Newsletter](#-newsletter) > - [✅ Action Items](#-action-items) > - [🧪 Hypotheses](#-hypotheses) > - [📊 Methodology](#-methodology) > - [❓ Questions](#-questions) > - [🔮 Future Research](#-future-research) > - [💡 Implications](#-implications) > - [🧠 Learning Styles Assessment](#-learning-styles-assessment) > - [📊 Accessibility Assessment](#-accessibility-assessment) > - [🌍 DEIB Assessment](#-deib-assessment) > - [✅ Logical Validity](#-logical-validity) > - [🛡️ DARVO Analysis](#-darvo-analysis) > - [🎯 Conclusion](#-conclusion) > ### 🔗 References > - [Advisory: CVE-2026-87902 / GHSA-7hp8-65ch-5whp](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp) > - [WordPress 7.1.2 download](https://wordpress.org/download/) > ## 📝 Summary > - WordPress core 7.1.2 is a security-only release fixing one critical-severity vulnerability. > - An unauthenticated attacker can, under certain server and active-theme preconditions, force page template resolution to include an arbitrary readable local PHP file outside the active theme's directories — a Local File Inclusion that can escalate to remote code execution (RCE) when those preconditions hold. > - Disclosed responsibly by Robert Ressl; tracked as CVE-2026-87902 / GHSA-7hp8-65ch-5whp. > - Release led by John Blackbourn; 22 named contributors credited. > - Backports are being shipped to every branch still eligible for security fixes (currently back through 4.7); sites on automatic background updates receive the fix without action. > - Risk/tradeoff: severity is high (RCE-capable), but exploitability is conditional — the post does not specify which server configs or theme patterns satisfy the preconditions, so site owners can't self-assess exposure from this post alone. > - Bottom line: update to 7.1.2 immediately regardless of whether your specific setup can be confirmed vulnerable; the cost of updating is near zero and the cost of being wrong about exposure is RCE. > ## 📖 Main Content > The vulnerability class is Local File Inclusion (LFI) in page **template resolution** — the core routine that decides which theme template file renders a given request. Normally this resolution is constrained to files inside the active theme's own directory tree. The bug lets an unauthenticated request influence that resolution enough to pull in a file *outside* those directories, provided the attacker can point it at something already readable on the server (a log file, an uploaded file, a config file, etc.). LFI becomes RCE when the included file's contents can be made to contain executable PHP — a well-known escalation path (e.g., poisoning a log file with a PHP payload via another input, then including that log). The post is explicit that both a **server environment condition** and an **active theme condition** must be met, meaning exposure is theme- and hosting-dependent rather than universal to every 7.1.x install — a meaningfully different risk than an unconditional unauthenticated RCE. > No CVSS score, affected-version floor (beyond "eligible branches back through 4.7"), or technical writeup of the exact preconditions is included in this announcement; that detail lives in the linked GHSA advisory, not in the page itself. > ### 🗒️ Notes > - Not a transcript; no timestamps. > - "Unauthenticated attacker" + "page template resolution" + "outside active theme directories" is the load-bearing phrase — it describes a path-traversal-style LFI in the template loader, not a plugin/theme-specific bug. > - Backport floor of "4.7" implies the vulnerable code path has existed in core for roughly a decade (4.7 shipped December 2016), which is a notable detail the post states as a fact (backport scope) without commenting on it as a fact (how long the bug existed). > - Automatic background updates cover this by default for sites that have them enabled — the post frames manual update as the fallback, not the default expectation. > ## 📚 References > - [WordPress 7.1.2 download](https://wordpress.org/download/) — primary source for the patched build > - [GHSA-7hp8-65ch-5whp / CVE-2026-87902](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp) — the technical advisory; likely holds the precondition detail this post omits > - [Robert Ressl](https://ressl.ch/) — reporter credited for responsible disclosure > - Contributor profile links (w.org/@handle) for all 22 credited contributors — provenance, not evidence > ## 🗣️ Paraphrase > - This release exists for one reason: patch a critical bug that lets an attacker who isn't even logged in trick WordPress's template-loading logic into pulling in a PHP file it shouldn't have access to, which can turn into full code execution if the server and theme happen to be set up a certain way. > - Update now; if your host runs the standard automatic background updates, this may already be handled without you doing anything. > ## 📰 Newsletter > - 🚨 Patch day: WordPress 7.1.2 is out and it's security-only — a critical LFI-to-RCE bug in page template resolution, credited to Robert Ressl (CVE-2026-87902 / GHSA-7hp8-65ch-5whp), fixed by a crew led by John Blackbourn. If you manage sites for clients, don't wait on this one: confirm auto-updates are actually enabled, or push the update manually today. Backports reach all the way to 4.7, so even legacy installs get covered — but "covered eventually" isn't the same as "covered now." > ## ✅ Action Items > #### WordPress > - Core: given a ~decade-old vulnerable path (back to 4.7), worth a retrospective on why template-resolution path handling wasn't caught by earlier hardening passes; performance/security budget review for the template loader. > - Core Security Management: the GHSA advisory should get cross-posted with precondition detail into practitioner-facing channels (this WordPress.org post alone gives no way to self-assess exposure). > - Hosting: hosts should confirm this backport pipeline actually lands to their managed legacy branches, not just check "eligible" as a box. > - Support: prep a plain-language "am I affected" FAQ, since the post's precondition language ("certain conditions... server environment and... active theme") is too abstract for most site owners to self-triage. > #### OSPO > - Security Management: this is a clean example case for an embargo-to-disclosure timeline writeup (Ressl report → coordinated fix → backport → public advisory) — useful raw material for internal OSPO security process documentation. > ## 🧪 Hypotheses > - H1: The LFI is a path-traversal-class flaw in whatever function resolves `template_path`/`locate_template()`-style lookups, insufficiently validating that a resolved path stays within `get_template_directory()`/`get_stylesheet_directory()`. > - H2: The "active theme condition" refers to themes that pass user-influenced input (e.g., a query var or URL segment) into a template-part or `get_template_part()`-style call without sanitization — meaning most default/core themes are not the trigger; a subset of themes with dynamic template loading are. > - H3: The "server environment condition" refers to PHP configuration (e.g., `allow_url_include`, or simply the presence of a locally-writable/readable file an attacker can poison, like access logs) needed to convert the LFI into RCE. > - H4: Given the 4.7 backport floor, the vulnerable code has been present since template-loading internals were last substantially restructured, and no later refactor happened to close it. > - H5: Sites using popular third-party themes with custom template-routing logic are disproportionatel This security release features a fix for a critical severity security vulnerability. **Because this is a security release, it is recommended that you update your sites immediately.** You can [download WordPress 7.1.2 from WordPress.org](https://wordpress.org/download/), or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically. #### Security update included in this release The security team would like to thank [Robert Ressl](https://ressl.ch/) for responsibly disclosing that an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to remote code execution (RCE). #### Thank you to these WordPress contributors This release was led by [John Blackbourn](https://w.org/@johnbillion). WordPress 7.1.2 would not have been possible without the contributions of the following people: [Aaron Jorbin](https://w.org/@jorbin), [Aki Hamano](https://w.org/@wildworks), [Alex Concha](https://w.org/@xknown), [Ehtisham Siddiqui](https://w.org/@ehti), [fiocavallari](https://w.org/@fiocavallari), [Jb Audras](https://w.org/@audrasjb), [Jeffrey Paul](https://w.org/@jeffpaul), [Jeremy Felt](https://w.org/@jeremyfelt), [Joe McGill](https://w.org/@joemcgill), [John Blackbourn](https://w.org/@johnbillion), [Lance Willett](https://w.org/@lancewillett), [Manuel Camargo](https://w.org/@sirlouen), [marcs0h](https://w.org/@marcs0h), [martin.krcho](https://w.org/@martinkrcho), [Mukesh Panchal](https://w.org/@mukesh27), [Olga Gleckler](https://w.org/@oglekler), [Pascal Birchler](https://w.org/@swissspidy), [Peter Wilson](https://w.org/@peterwilsoncc), [Rajin Sharwar](https://w.org/@rajinsharwar), [Ressl](https://w.org/@ressl), [Shail Mehta](https://w.org/@shailu25), [Stephanie Walters](https://w.org/@pypwalters), and [vortfu](https://w.org/@vortfu). #### CVE and GHSA references Further details can be found in the advisory: [CVE-2026-87902 / GHSA-7hp8-65ch-5whp](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp). #### Backports As a courtesy, the security fix is being backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, **only the most recent version of WordPress is actively supported**. The backports are in progress and will ship as they become ready., WordPress 7.1.2 Release, WordPress.org, 01m34qq1wp21wy5zawhhnrwrzr.