WordPress website owners should check their sites immediately. WordPress 7.1.2 was released on 22 September 2026 to fix a critical core vulnerability, and security researchers have since reported active attempts to exploit it.
If your site is running WordPress 7.1.0 or 7.1.1, update to WordPress 7.1.2 now. Patched point releases are also available for eligible older branches, but running an old branch should be treated as a temporary position rather than a long-term maintenance strategy.
What to do now:
- Open Dashboard > Updates and check your installed WordPress version.
- Create or confirm a recent backup.
- Install the patched core release offered in your dashboard.
- Test your forms, checkout, login and other important features.
- Investigate the site if it was exposed and you notice suspicious activity.
What happened in WordPress 7.1.2?
The official WordPress 7.1.2 announcement describes this as a critical security release and recommends updating immediately.
The vulnerability, tracked as CVE-2026-87902, concerns the way WordPress resolves page templates. Under specific conditions, an attacker who is not logged in could cause WordPress to include a readable PHP file from outside the active theme’s normal directories.
If the required theme and server conditions are present, this can lead to remote code execution. In plain English, an attacker may be able to make the server run code they control. That can put website files, data and availability at risk.
Not every WordPress configuration meets the conditions needed for the most serious outcome. However, trying to assess your exposure before updating wastes valuable time. Installing the patch is the dependable response.
The vulnerability is being actively exploited
This is no longer only a theoretical security problem. Patchstack reported that it detected the first probing activity on 22 September 2026, the same day the patch became public. Its monitoring subsequently identified attempts to use the vulnerability to write PHP files to servers.
The Cyber Security Agency of Singapore has also issued an active-exploitation alert, advising affected users and administrators to update immediately.
Public scanning tools are now circulating, according to Patchstack’s technical incident update. That makes broad, automated scanning more likely and reduces the value of simply assuming a small business website will not attract attention.
Which WordPress versions need updating?
The official security advisory lists affected releases from WordPress 4.7 through WordPress 7.1.1. The correct patch depends on the branch currently installed:
| Affected branch | Patched release |
|---|---|
| WordPress 7.1.0–7.1.1 | 7.1.2 |
| WordPress 7.0.0–7.0.5 | 7.0.6 |
| WordPress 6.9.0–6.9.8 | 6.9.9 |
| WordPress 6.8.0–6.8.9 | 6.8.10 |
| WordPress 6.7.0–6.7.8 | 6.7.9 |
| WordPress 6.6.0–6.6.8 | 6.6.9 |
| WordPress 6.5.0–6.5.11 | 6.5.12 |
| WordPress 6.4.0–6.4.11 | 6.4.12 |
Patched releases are also available for older eligible branches down to WordPress 4.7.37. You can check the full WordPress security advisory for the complete version list.
If a site is running WordPress 4.6 or earlier, no backported patch is available for this issue. It needs a carefully managed upgrade rather than another delay.
Although WordPress has provided older branches with this particular fix, only the latest major WordPress release is actively supported. If compatibility problems are keeping your site on an old version, identify and resolve them after applying the available security patch.
How to install the update safely
1. Confirm that you have a usable backup
Make sure you have a recent copy of both the website files and database. A successful backup notification does not always prove that the backup can be restored, so follow our guide to testing a WordPress backup as part of your normal maintenance routine.
Because exploitation is active, do not postpone the security update for days while arranging an elaborate backup process. If you cannot create a reliable backup promptly, ask your host or WordPress support provider for help.
2. Open the WordPress Updates screen
Log in to WordPress and go to Dashboard > Updates. Install the patched version offered for your current branch. The official WordPress updating guide provides instructions for one-click and manual updates.
Some sites will receive this maintenance and security release automatically. Do not rely on that assumption: open the dashboard and verify the version shown.
3. Check the site after updating
Once the update has completed, clear relevant website and server caches. Then check:
- the homepage and key landing pages;
- contact, quote and newsletter forms;
- customer login or membership features;
- WooCommerce basket, checkout and payment flows;
- the WordPress dashboard and scheduled processes.
A security point release should normally be a low-risk update, but a short functional check can catch an unrelated compatibility or caching problem quickly. Highly customised and transactional sites can use a WordPress staging site for a rapid check, provided this does not create a lengthy delay in patching the live website.
What if the site was not patched promptly?
Updating closes the vulnerability, but it does not remove malicious files or changes made before the patch was installed.
Remaining unpatched for a period does not automatically mean that your website was compromised. However, the absence of an obvious warning, defaced page or redirect is not proof that everything is clean.
If the site was exposed after 22 September, ask your host or security provider to review access logs and recent file changes. Security teams should look for requests and activity associated with CVE-2026-87902 rather than relying only on a basic front-end check.
You should also:
- look for unfamiliar administrator accounts using our WordPress admin user audit;
- review unexpected file changes and recently modified PHP files;
- check whether security, hosting or uptime tools have raised alerts;
- investigate unexplained redirects, new pages, spam links or search results;
- avoid deleting evidence before logs and affected files have been examined.
If there are signs of compromise, use a structured cleanup rather than replacing a few suspicious files and assuming the problem is solved. ThriveWP provides a WordPress malware removal service for website owners who need professional investigation and cleanup.
Do not let security updates become an occasional task
This incident demonstrates how quickly the window between a patch being released and attackers testing websites can shrink. WordPress core, plugins, themes, backups and monitoring all need regular attention.
A WordPress care plan can help make updates, backups and routine checks part of an organised process rather than something remembered only after a security alert.
Need help checking or updating your WordPress site?
If the update has failed, your website is behaving unexpectedly or you are unsure whether it remained exposed, Talk To Us. We can help you work out the appropriate next step without unnecessary jargon.
For future WordPress security alerts and a free site-care guide, subscribe to the ThriveWP newsletter.
