Version 7.1.2 of WordPress is out, and it exists to close a single hole: CVE-2026-87902, a critical path traversal that an unauthenticated visitor can reach, with no account required and nothing a logged-in user has to do.
The fault sits in get_page_template(), the routine that decides which theme file renders a given page. An attacker who steers that lookup toward any readable PHP file on the server gets the platform to include it. Where the web server and the active theme happen to align the right way, that include turns into code execution. WordPress scored the flaw 9.2 under CVSS v4.0.
Last week’s security release does not cover it. WordPress pushed out 7.1.1 on September 17, and that build sits inside the affected range alongside everything from 4.7.0 onward, so an administrator who patched within the past several days still has work to do. Nothing in that earlier update touches this bug.
Maintainers backported repairs to 24 branches, from 7.1.2 all the way down to 4.7.37. Where automatic background updates are switched on, the fix installs with no human in the loop. Anyone running with them turned off has to log in and open the Updates screen. For the point releases, the 7.0.x line lands at 7.0.6, 6.9.x at 6.9.9 and 6.8.x at 6.8.10.
No exploitation has been published so far, and there is no workaround other than applying the update. One practical wrinkle: because the flaw lives in core rather than in a plugin, patch management tools that watch add-ons only will not raise a flag. On installs that cannot update themselves, checking the core version by hand is the only way to be sure.
