WordPress 7.1.2 Fixes Actively Exploited Security Flaw

WordPress has released an urgent security update for a critical flaw in WordPress core that attackers are already trying to exploit. WordPress 7.1.2 was released on 22 September 2026, and website owners are being told to update immediately.

The vulnerability, tracked as CVE-2026-87902, can allow an attacker who has no account or password to make WordPress load a PHP file from outside the active theme folders. Under the right server and theme conditions, that can lead to remote code execution and potentially complete control of the website.

For UK SMEs, the practical message is simple: confirm that every WordPress website you own or manage has received the patched release, then check that it is still working normally.

What has changed in WordPress 7.1.2?

WordPress 7.1.2 closes a path-traversal weakness in the way WordPress selects page templates. The official WordPress security notice describes it as a critical-severity vulnerability and recommends updating sites immediately.

The affected code could be manipulated into looking outside the directories where WordPress should normally load theme templates. That gives an unauthenticated attacker a route to include another readable PHP file already present on the server.

WordPress has applied the fix to current and older branches that still receive security backports. A website does not necessarily need to make a major-version jump to receive the protection, but it must install the appropriate security release offered through its update system.

Is the WordPress vulnerability being actively exploited?

Yes. Security researchers reported exploitation attempts beginning on 22 September, the same day the fix was released. Early attempts included requests designed to reach a PHP component called pearcmd.php and use it to write attacker-controlled files to the server.

Seeing exploit traffic does not mean every unpatched WordPress site has been compromised. Successful remote code execution depends on additional conditions in the active theme and server configuration. However, automated attackers can scan large numbers of sites very quickly, so waiting to see whether a particular website is targeted is not a sensible response.

The fact that exploitation followed disclosure within hours is what makes this more urgent than a normal maintenance update.

Which WordPress websites are affected?

WordPress core versions from 4.7 up to and including 7.1.1 contain the vulnerable code. The main fixed release is WordPress 7.1.2, with security backports available for older eligible branches.

Reaching full remote code execution requires the attacker to find the right combination of conditions. Researchers identify two particularly important factors:

• The active parent or child theme contains a top-level directory whose name begins with page-, such as page-templates.
• A useful PHP file exists elsewhere on the server, is readable by the web-server account and can be abused when included.

Those conditions reduce the number of sites that can be fully taken over, but they are common enough that WordPress and security researchers are treating the issue as critical. Website owners should update rather than attempting to decide whether their particular hosting configuration is safe.

What should businesses and website administrators do now?

1. Check the WordPress version. Sign in to the WordPress dashboard and open Dashboard > Updates. Confirm that the current security update has been installed.
2. Take or confirm a recent backup. Make sure both the website files and database are covered before any manual update.
3. Install the security release. Use the update offered by WordPress or ask the hosting provider or website maintainer to apply it.
4. Test the website afterwards. Check the homepage, key service pages, contact forms, login area and any payment or booking functions.
5. Check automatic updates. Many WordPress sites will receive the security fix automatically, but do not assume that happened without verifying the installed version.
6. Review sites that were exposed. If a site remained unpatched after 22 September, check logs, administrator accounts and recently changed PHP files for suspicious activity.

If someone else maintains the website, ask for a clear confirmation of the installed WordPress version and when it was checked.

What will website owners or visitors notice?

Most legitimate updates should be quiet. An administrator may receive an automatic-update email, and the WordPress dashboard should show that the security release is installed.

A successful attack may also be difficult to spot. The website can continue to look normal while an attacker adds hidden files, creates a backdoor, redirects selected visitors or uses the server for spam and malware.

Warning signs include unfamiliar administrator accounts, unexpected PHP files, unexplained redirects, search-engine security warnings, changed pages or a sudden increase in hosting activity. None of those signs proves this particular vulnerability was used, but each deserves investigation.

What should you do if the website may already be compromised?

Updating closes the vulnerability, but it does not remove an attacker who has already gained access. If logs or files show suspicious activity, isolate the website and involve the hosting provider or a security specialist.

A proper response should preserve useful logs, compare files against known-clean copies, remove unauthorised accounts and malicious code, rotate WordPress and hosting credentials, review database changes and restore from a known-clean backup where appropriate.

Do not simply reinstall the update and assume the incident is over. An attacker may have created another method of access that remains after the vulnerable code has been patched.

What happens if a business does nothing?

An unpatched site remains exposed to automated scanning for a flaw that is already public and being tested in the wild. Where the necessary conditions are present, an attacker could execute code on the server without first obtaining a username or password.

That can lead to website takeover, stolen form submissions, malicious redirects, search-engine blacklisting, damage to the company’s reputation and time-consuming recovery work. If personal information is accessed, the business may also need to assess its data-protection obligations.

The cost and disruption of checking and updating a website are normally far lower than cleaning up a compromised one.

Why this matters to UK SMEs

Many small-business websites were built by an agency or freelancer and then left running for years. The business may pay for hosting but have no written agreement identifying who is responsible for security updates.

This incident affects WordPress core rather than an obscure optional plugin, so every WordPress site deserves a version check. It also shows why a business should know who maintains its website, where backups are stored and how quickly urgent updates are handled.

Our guide, Is Your Business Website a Security Risk?, explains the wider risks from outdated WordPress software, plugins and themes. Businesses should also treat website maintenance as part of their wider cyber-security planning, not as a one-off design task.

Sources

• WordPress.org: WordPress 7.1.2 security release
• Patchstack: technical analysis of CVE-2026-87902
• Wordfence: critical path-traversal vulnerability advisory
• The Hacker News: observed exploitation activity

Security information can change as investigations continue. Follow the WordPress security notice and your hosting provider’s advice for the latest guidance.

The important point

Every business with a WordPress website should confirm that the patched security release has been installed. The vulnerability is in WordPress core, does not require an attacker to sign in and is already attracting exploit attempts.

If you cannot establish who maintains your site or whether it has been updated, contact KES for practical help.