WordPress 7.1.2 is under active attack: update now and verify

If you run a personal blog, a church site, a hobby shop page, or any other small WordPress install, treat WordPress 7.1.2 as a same-day update. This is a security-only release for a critical bug, and attackers did not wait for the weekend.

WordPress.org shipped 7.1.2 on September 22, 2026. Release lead John Blackbourn credits Robert Ressl for responsibly disclosing the issue. The advisory points to CVE-2026-87902 / GHSA-7hp8-65ch-5whp. Because it is a security release, WordPress recommends updating immediately from Dashboard → Updates, or letting automatic background updates finish, then confirming the version yourself.

What the bug is (plain language)

WordPress describes an unauthenticated attacker who can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If both the server environment and the active theme meet the relevant preconditions, that path can lead to remote code execution (RCE).

You do not need to reproduce those preconditions at home. You need the patched core. Security researchers have written about themes with a top-level page- directory and readable helper scripts such as pearcmd.php on some PHP setups. That detail is for context, not a DIY exploit hunt on your live site.

Who is affected, and what fixes it

Patchstack summarizes the range as WordPress Core 4.7.0 through 7.1.1, with fixed builds including 7.1.2, plus branch updates such as 7.0.6, 6.9.9, 6.8.10, and further backports. WordPress says the fix was backported through branches still eligible for security updates (currently through 4.7), while reminding everyone that only the newest WordPress line is actively supported.

If your dashboard still shows 7.1.1 or older on the 7.1 line, you are behind. If you are on an older major that still gets security backports, take the patched build for that branch rather than ignoring the advisory.

This is a different bug from the earlier WordPress 7.1.1 maintenance and security release and from last summer’s WordPress Core CVE-2026-63030 emergency. Same habit either way: confirm the version that is actually running.

Active exploitation: update, do not play incident responder

The Hacker News (September 24, 2026) and Patchstack’s follow-up analysis report probing within hours of the patch, then escalation toward real exploitation patterns, including requests that involve pearcmd.php. THN notes fixed versions such as 7.1.2 (and the branch builds listed above) and urges administrators to apply them quickly.

For a home or personal site owner, the job is simple:

• Update to a patched release.
• Verify the version stuck.
• Do not start scanning your own site with random exploit tools or copy-pasted payloads from Twitter threads. That is how people break a working site, trip host abuse filters, or convince themselves they “tested” something they did not understand.

If the site already looks defaced, redirects weirdly, or your host flagged malware, restore from a clean backup after updating, or open a host support ticket. That is still not a reason to delay the core update.

Update WordPress 7.1.2 now

1. Backup first if your host does not already snapshot before updates. Files plus database, something you can restore.
2. Open Dashboard → Updates.
3. Confirm WordPress core shows 7.1.2 available (or that you are already on it, or on the correct patched build for your older branch).
4. Click Update Now and wait for the success screen. Do not close the tab mid-flight.
5. If automatic background updates are enabled, they may already be applying. Still log in afterward and verify. Auto-update is helpful, not telepathy.
6. If the dashboard cannot reach the updater, download the release from WordPress.org and follow your host’s manual update path, or use WP-CLI if you already know that workflow.
7. If your host pins versions or delays core bumps, open a ticket with a screenshot of Dashboard → Updates and ask them to allow 7.1.2 (or the patched build for your branch).

Confirm it stuck

After the update:

1. Check Dashboard → Updates (or At a Glance) for the running version. On the 7.1 line you want 7.1.2.
2. Load the front page and one editor screen. Spot-check a post and a media upload if you use those often.
3. If you maintain more than one public site, write down which domains you updated. Forgotten staging and old campaign sites are how “I thought we patched” turns into a mess.

Do / don’t

Do

• Update the same day when WordPress ships a critical security-only release
• Verify the version after auto-update claims success
• Keep unused themes and plugins deleted, not merely deactivated
• Ask your host for help if the panel blocks the update

Don’t

• Skip the update because “it is only a brochure site”
• Hunt for exploit writeups instead of clicking Update Now
• Paste random “scanner” scripts against your live site
• Assume an ancient major is fine forever just because backports exist

Bottom line

WordPress 7.1.2 (September 22, 2026) is a critical security-only fix for CVE-2026-87902, credited to Robert Ressl and led by John Blackbourn. Attackers started probing within hours, and researchers have described exploitation attempts involving patterns such as pearcmd.php. From Dashboard → Updates, install the patched build, confirm 7.1.2 (or your branch’s fixed release), and move on. Source of truth: the official WordPress.org news post. Secondary reporting: The Hacker News and Patchstack.

Image: WordPress.org default OG image from the 7.1.2 release news post (og:image wordpress-default-ogimage.png).