WordPress has released an emergency security update addressing a critical vulnerability in WordPress Core that could, under certain conditions, allow an unauthenticated attacker to achieve remote code execution.
The vulnerability, tracked as CVE-2026-87902, was disclosed on 22 September and has been rated 9.2 out of 10 (Critical) under CVSS. WordPress has released version 7.1.2 along with corresponding security updates for older supported branches.
If your organisation runs WordPress, this is an update that should be treated seriously.
What is the vulnerability?
The vulnerability relates to the way WordPress resolves page templates.
In simple terms, an unauthenticated attacker could potentially manipulate this process to make WordPress include a readable PHP file from outside the expected theme directories.
Under the right combination of conditions, this can potentially lead to remote code execution, meaning an attacker could execute code on the web server without first needing to log in.
There are specific prerequisites for the most serious outcome. These include characteristics of the active theme and the server’s PHP environment, so not every WordPress website will necessarily be exposed to the same level of risk.
That doesn’t change the recommended response.
The vulnerability should be patched.
Which WordPress versions are affected?
The vulnerability affects a very broad range of WordPress versions, including versions from 4.7 through 7.1.1.
WordPress has backported the fix across its supported branches, with 7.1.2 being the current release containing the fix. Corresponding patched versions have also been made available across older branches.
Importantly, this means that even a website updated to WordPress 7.1.1 only a few days ago may still require another update.
WordPress 7.1.1 was released on 17 September as a security and maintenance release containing 11 security fixes. The newly disclosed vulnerability was not fixed until the 7.1.2 release on 22 September.
That’s a useful illustration of why website security cannot be treated as a one-off exercise.
What should website owners do?
The immediate priority is to establish which version of WordPress your website is running and update to the appropriate patched release.
It’s also sensible to confirm that the update completed successfully and that the website continues to operate normally afterwards.
For websites with more complex hosting environments, custom themes or other integrations, the update should be managed carefully rather than simply clicked and forgotten.
A proper maintenance process should include:
- Checking the current WordPress version
- Applying the appropriate security update
- Confirming the update completed successfully
- Testing key website functionality
- Reviewing security and access logs where appropriate
- Checking for signs of compromise if the website was running a vulnerable version
- Confirming backups are available and recoverable
This is why ongoing website maintenance matters
This vulnerability highlights something we regularly talk to clients about.
Website maintenance isn’t simply updating plugins once a month.
New vulnerabilities can be disclosed at any time.
A security update can be released shortly after your last scheduled maintenance cycle.
A vulnerability can affect WordPress Core itself rather than a plugin.
And sometimes a vulnerability can affect software that was considered secure only days earlier.
Having an ongoing maintenance agreement means there is a defined responsibility for keeping your website’s software and infrastructure under review and responding when important updates are released.
It doesn’t make a website immune to vulnerabilities, and no responsible provider can guarantee that.
What it does provide is an ongoing process.
Someone is responsible for monitoring the environment.
Someone is responsible for identifying relevant updates.
Someone is responsible for applying them.
And someone is responsible for checking that the website remains operational afterwards.
Security is an ongoing process
The WordPress ecosystem is continuously evolving.
New features are released.
Vulnerabilities are discovered.
Security researchers report issues.
Developers release patches.
Attackers look for websites that haven’t been updated.
This cycle doesn’t stop when a website launches.
That’s why we believe website security should be treated as part of the ongoing management of a digital asset, rather than something that happens once during development.
What should you do now?
If you manage a WordPress website, check the current WordPress version and make sure the appropriate security update has been applied.
If you’re not sure who is responsible for monitoring and applying security updates to your website, that’s worth resolving.
A website without an ongoing maintenance process is relying on someone noticing the next vulnerability in time.
At Codex, ongoing website maintenance is designed to provide that responsibility, helping keep WordPress Core, plugins and the wider website environment maintained as new security issues emerge.
