WordPress 7.1.2 is a critical security release published on September 22, 2026. Update promptly, then verify the site instead of treating the update button as the end of the job.
Why 7.1.2 matters
WordPress.org describes 7.1.2 as a security release fixing a critical-severity vulnerability and recommends updating sites immediately.
What the vulnerability involves
The official release notes say an unauthenticated attacker can, under specific server and theme preconditions, make template resolution include a chosen readable local PHP file outside the active theme directories. In affected conditions, this can lead to remote code execution.
A practical update path
Confirm a restorable backup, update WordPress core, clear relevant caches, and run a short smoke test through the public site, wp-admin, login, forms and checkout paths that matter to the site.
Check compatibility, not just availability
A successful core update does not prove every plugin, theme or custom integration still behaves correctly. Watch error logs and repeat the workflows that are site-critical.
If you suspect a compromise
Do not rely on the update alone. Preserve logs, review unexpected file changes and privileged users, rotate credentials where appropriate, and investigate before declaring the site clean.
Tell us what you are trying to achieve. We’ll tell you what the WordPress work actually involves.
Start a project →