WordPress 7.1.2 Patches a Critical Core Vulnerability: Patched Versions by Branch and How to Check Your Site

On September 22, 2026, WordPress released 7.1.2, a security release patching a core vulnerability it rates as critical severity. The patch reaches back from the current 7.1 branch all the way to the 4.7 branch, with each branch getting its own patched version. The vulnerability can be triggered without logging in, but it can only lead to remote code execution when preconditions on both the server environment and the active theme are met. On September 25 (US time), the US Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation. Whichever branch your site is on, it is worth checking your version number again.

This piece was checked on September 26, 2026, against WordPress.org's “WordPress 7.1.2 Release” announcement and its “Dashboard screen” documentation, the GitHub security advisory GHSA-7hp8-65ch-5whp, and the CISA alert; it does not test any site or attack technique, and it does not recommend a host or theme to buy — it only lays out what these documents say and do not say.

What the September 22 Patch Fixed: A Conditional Core Vulnerability

WordPress.org published “WordPress 7.1.2 Release” on September 22, 2026, opening with: “This security release features a fix for a critical severity security vulnerability.” It goes on: “Because this is a security release, it is recommended that you update your sites immediately.” That is a recommendation, not a mandate.

The release post explains that an unauthenticated attacker who does not need to log in can trigger the issue under certain conditions; if the preconditions on both the server environment and the active theme are met, this “can lead to” remote code execution — it is not guaranteed to happen. GHSA separately names two server environments where the server-side precondition is already met under an official image or a default configuration (one of them limited to a specific PHP version); the attack technique and environment details are not discussed here.

This vulnerability has two official names, presented side by side: the GitHub security advisory GHSA-7hp8-65ch-5whp names it “Unauthenticated path traversal in page-template resolution leading to conditional RCE”; CISA's name for it is “WordPress Core Remote File Inclusion Vulnerability.” The severity rating of Critical and the CVSS 4.0 overall score of 9.2 are GHSA's own scoring, not a score the two agree on.

Which Versions Are Affected: Patched Versions by Branch

GHSA's affected-versions column lists branch by branch, from the current 7.1 branch (7.1.0–7.1.1) down through older branches like 6.7 and 6.6, to the oldest, the 4.7 branch (4.7.0–4.7.36); the patched-versions column lines up row for row with the affected column. The version numbers for the 7.1, 7.0, 6.9, and 6.8 branches are laid out in the table below; for the rest, see GHSA's branch-by-branch table. Readers should match the patched version for their own branch, not install 7.1.2 across the board.

7.1.1 is also within the affected range, meaning that even a site already updated to 7.1.1 needs to update again. The release post says the fix was backported “as a courtesy” to all branches still eligible to receive security fixes, noting in parentheses “currently through 4.7” — that is, it currently reaches back only as far as the 4.7 branch.

The same paragraph in the release post also notes that only the most recent version of WordPress is actively supported; older branches getting this patch is a courtesy backport, not a sign that the branch is still actively supported. Versions earlier than 4.7 do not appear in GHSA's affected-versions table — that is because the table does not list them, not because those versions are unaffected.

How to Check Your Own Site: Three Steps

Step one is checking your version number: the Dashboard home screen shows the At a Glance widget by default, and per WordPress.org's documentation, a line at the bottom of that widget tells you which WordPress version your site is running (if the widget is hidden, you can turn it back on in the Screen Options panel). Match that version number against the table above or the GHSA page to confirm whether you are on the patched version for your branch. If you are not, the release post's update path is to go to the Dashboard, click “Updates,” then click “Update Now” — or you can download 7.1.2 directly from WordPress.org and install it.

Step two: do not assume automatic updates have already finished. The release post says: “If you have sites that support automatic background updates, the update process will begin automatically.” That is “will begin,” not “have completed” — check your version number to confirm, rather than relying on whether you received an update notification.

Step three: if your site is managed or maintained by someone else, you can simply ask them to report back the updated version number — this is the editors' suggestion, not something WordPress's documentation states.

Beyond this update, if your site's routine maintenance has not been kept up, What website maintenance involves: a routine for backups, updates, and incident reports covers that.

What “Actively Exploited” Means — and Does Not

CISA's Known Exploited Vulnerabilities (KEV) catalog is a list CISA maintains based on evidence of actual exploitation. On September 25 (US time), CISA added this vulnerability to the KEV catalog under the name “WordPress Core Remote File Inclusion Vulnerability” — alongside GHSA's name, not replacing it.

CISA's alert states that the related directive requires US Federal Civilian Executive Branch (FCEB) agencies to prioritize rapid remediation of high-risk vulnerabilities, and that it applies only to those agencies; for every other organization, CISA merely encourages risk-based vulnerability management and prioritizing fixes for vulnerabilities in the KEV catalog — none of which binds site owners in Taiwan.

CISA's alert does not state the number of victims, where they are, or who the attackers are — only that the finding is based on evidence of active exploitation. Neither WordPress's September 22 release post nor the GHSA advisory mentions that this vulnerability has been exploited; the exploitation finding comes from CISA alone.

What We Still Do Not Know: Do Not Fill In What the Documents Do Not Say

None of the four documents cited here mention Taiwan — that only means the documents do not say, not that Taiwan is unaffected.

The GHSA page lists no temporary mitigation beyond updating; switching themes, deleting directories, or changing server settings are not alternatives WordPress has proposed — to patch it, you update.

The release post does not say how many sites have already updated via automatic background updates, and there is no such figure here either. This vulnerability is in WordPress Core — the release post, GHSA, and the CISA alert all discuss it without mentioning plugins, so you cannot say installing a security plugin makes it a non-issue.

To check the latest status yourself, look at WordPress.org's news page for a newer security release, and see whether the GHSA-7hp8-65ch-5whp advisory has been updated; if WordPress later ships a version newer than 7.1.2, install that one instead.

2026 Tech News Roundup: Key Points on Hardware, Platforms, Telecom, and Regulation

EU Cyber Resilience Act Reporting Obligations Begin September 11: Who Must Report, How Fast

• Tech & industry
• Tech news