WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE
ResearchWordPressOur summary
WordPress 7.1.2 addresses CVE-2026-87902, an unauthenticated local file inclusion flaw in page template resolution affecting WordPress Core from 4.7.0 through 7.1.1. The issue can allow remote code execution under certain server configurations, so administrators should apply the available fixed release as soon as possible.
Below is the opening; the full story is at Patchstack.
From Patchstack
WordPress 7.1.2 landed on 22 September 2026. It’s a security-only release with a single fix, and that fix is the most serious thing WordPress has patched in a while: an unauthenticated local file inclusion in page template resolution that can reach remote code execution.
Patchstack customers are protected by a RapidMitigate rule. We still recommend updating to the most recent version of WordPress available.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.