WordPress 7.1.2 Security Update: What Philippine Site Owners Must Do Now

A critical WordPress security patch arrived in late September and calls for prompt action. CVE-2026-87902 is a flaw in the page template system that an unauthenticated attacker can exploit without credentials. WordPress released 7.1.2 for the current branch and separate fixed releases for older branches, so you can usually patch within your existing branch. The GitHub security advisory lists a CVSS v4.0 score of 9.2 out of 10.

What Is CVE-2026-87902?

WordPress uses a function called get_page_template() to determine which PHP template file should render a given page on your site. Normally, this resolution process is bounded by the active theme's directory—your site loads its own templates and nothing else from outside that folder.

CVE-2026-87902 is a path traversal vulnerability, classified as CWE-98 (Improper Control of Filename for Include/Require in PHP). WordPress expects template files to come from the active theme's directories. This flaw breaks that boundary: an unauthenticated attacker can cause get_page_template() to include a readable local PHP file from outside those directories. If that file contains executable PHP code, the attacker gains a vector for remote code execution (RCE).

Path traversal flaws are rated seriously because external input controls which files the application runs.

Security researcher Robert Ressl discovered and responsibly disclosed this flaw. The advisory's CVSS v4.0 score of 9.2/10 reflects an attack that needs no authentication or privileges and is network-accessible with low complexity. WordPress released the fix in 7.1.2 on September 22, 2026, with separate fixed releases for older branches, as listed in the official WordPress 7.1.2 release notes.

Who Is Actually at Risk?

Not every unpatched WordPress site faces identical exposure. Exploiting CVE-2026-87902 requires two conditions to be present at the same time:

1. A theme directory layout the traversal can escape — the active parent or child theme contains a top-level directory whose name starts with page-, such as page-templates.
2. A readable local PHP file as the target — a PHP file outside the theme directories must exist and be readable by the web server.

This is why remote code execution is described as possible "under specific conditions." That does not mean you can safely postpone the update: your dashboard cannot show whether both conditions apply, so the only reliable action is to patch.

The 9.2 score reflects an unauthenticated, network-based, low-complexity attack; the extra conditions lower the practical hit rate, not the urgency. Wordfence has also published a public warning. Treat this as critical for any site, from a personal blog to an online store.

How to Check Your WordPress Version

Before updating, confirm which version your site is currently running:

• Log in to your WordPress admin dashboard and go to Dashboard > At a Glance. Your current WordPress version appears in the lower-right area of the widget.
• Alternatively, go to Dashboard > Updates. If a WordPress core update is available, it will appear at the top of the page with a security notice.
• You can also check the bottom-right corner of any admin screen, which typically shows the current WordPress version number.

Compare it with your branch's fixed version in the official WordPress 7.1.2 release notes: 7.1.2 for 7.1, 7.0.6 for 7.0, 6.9.9 for 6.9, 6.8.10 for 6.8, and 4.7.37 for 4.7, with other branches listed there. If your version is lower, update now. If it matches or exceeds it, no further core action is needed for this CVE, though themes and plugins should stay current. These older-branch fixes are courtesy backports, not a sign that older branches are actively supported, so plan a move to a current release when practical.

How to Update to WordPress 7.1.2

Update within your current branch where possible; this fix does not require a major-version upgrade. Always create a manual backup before updating a live business site, even if your plan includes daily automated backups.

Method 1 — WordPress Dashboard (recommended for most sites)

1. Log in to your WordPress admin and go to Dashboard > Updates.
2. A security update for your branch (for example 7.1.2 or 7.0.6) should appear at the top. Click Update Now. If only a major upgrade is offered, ask your host to apply your branch's fixed release.
3. Wait for the progress to complete. Do not close the browser tab or navigate away while the update is running.
4. WordPress will display a confirmation screen when finished. Go to Dashboard > At a Glance and verify the version matches your branch's fixed release, such as 7.1.2.

Method 2 — Auto-updates already enabled

If your site has WordPress core auto-updates turned on, which is common on managed WordPress hosting, your branch's fixed version may already be installed. Check Dashboard > At a Glance; if it shows the fixed version, no manual step is needed.

Method 3 — cPanel and Softaculous

If you installed WordPress through cPanel using Softaculous, open Softaculous, go to your WordPress installations, and click the update icon next to your site. This works without WordPress dashboard access.

What to Do After Updating

Confirming your branch's fixed release, or a later one, in your dashboard is the essential first step, but a few additional checks reduce your overall exposure:

• Update your active theme and all plugins. Go to Dashboard > Updates and apply any outstanding updates. This is general maintenance; it does not fix this Core CVE.
• Review administrator accounts. Go to Users > All Users and look for any unfamiliar accounts with Administrator or Editor roles. A site that was compromised before patching may have a backdoor user added.
• Run a malware scan. Use your hosting control panel's malware scanner, or a security plugin such as Wordfence, to check for unexpected file modifications. Security monitoring is not the same as a confirmed scan result, so run or request a scan yourself.
• Check your server and WAF logs. Review web-server or WAF logs in your control panel, or ask your host for help, and look for unusual requests around or before your update date. An activity-log plugin may not record template loading, so do not rely on it for this check.

If your review turns up signs of compromise—unknown administrator accounts, modified core files, or unexpected PHP scripts in your uploads folder—treat it as a separate incident. See our guide on recovering a hacked WordPress site for step-by-step instructions.

Common Mistakes to Avoid

Frequently Asked Questions