Update of 12 October: 7.1.2 is no longer enough
Two weeks after this vulnerability, on 6 October, WordPress followed up with 7.1.3. It closes seven more security issues. One of them let anyone read comments on private and unpublished posts without logging in; another let a comment still awaiting moderation carry malicious code into the comments admin screen. These fixes, too, went into every branch back to 4.7 on the same day.
If you updated in September, you need to update once more. What counts now is the right-hand column of the table further down.
What it is
Under certain conditions an unauthenticated attacker can make page template resolution include a chosen readable PHP file from outside the active theme directories. Where the server environment and the active theme line up, that can lead to remote code execution. This is how WordPress describes it in its own release post; it was reported by Robert Ressl.
The vulnerability is tracked as CVE-2026-87902.
Who is affected
The fix was backported to every branch still eligible for security fixes, currently back to 4.7. Affected is therefore any install sitting below the patched release of its own branch. The releases carrying this fix came out on 22 September 2026, the ones with the seven further fixes on 6 October:
| Branch | Fix of 22 September | Current since 6 October |
|---|---|---|
| 7.1 | 7.1.2 | 7.1.3 |
| 7.0 | 7.0.6 | 7.0.7 |
| 6.9 | 6.9.9 | 6.9.10 |
| 6.8 | 6.8.10 | 6.8.11 |
Older branches back to 4.7 received a release on both dates. If your number is lower than the one in the right-hand column for your branch, you are missing fixes.
How to find your version
In the admin area it is under Dashboard → Updates. From outside, without logging in, it also works: open your address with /wp-links-opml.php appended. The response contains a line reading generator="WordPress/…" with the number in it.
Do not rely on the generator tag in your home page source. Many themes put their own version there, which has nothing to do with WordPress. On one site we checked, that tag carried the theme's number while WordPress itself ran an entirely different release.
What to do
Update, today. In the admin area under Updates, click "Update Now". If you have automatic background updates enabled it arrives on its own, but check that it did.
If you would rather not touch an update because an agency built the site, that is what the agency is for. A short mail quoting the version number from this page is enough.
Why an old release costs more than it looks
A vulnerability like this becomes public with the release that fixes it, description included. From that moment automated scanners look for it, and they do not ask how small a business is. A compromised site costs two things at once: the site, and its standing with Google, which removes compromised sites from the index or flags them with a warning.