WordPress 7.1.2 Security Fix: What Business Owners Must Do Now

What did the WordPress 7.1.2 security update fix?

WordPress 7.1.2 is a security release published September 22, 2026. It fixes CVE-2026-87902, a critical flaw rated 9.2 under CVSS 4.0 that lets an unauthenticated attacker make WordPress include a PHP file from elsewhere on the server, which can lead to remote code execution. Every version from 4.7.0 to 7.1.1 is affected.

Which WordPress sites are exposed to CVE-2026-87902?

Any site running WordPress 4.7.0 through 7.1.1 has the vulnerable code. Whether an attacker can go all the way to running code depends on the theme and the server.

• September 22, 2026: WordPress 7.1.2 ships. The Hacker News reports Patchstack logged the first exploitation attempt at 11:49 UTC that same day.
• September 24, 2026: Help Net Security updates its story with Patchstack's note that attackers were using `pearcmd.php` to write PHP files to disk, that public scanning tools were circulating, and that attack traffic was running at more than ten times the first evening's volume.
• September 25, 2026: CISA adds CVE-2026-87902, listed as a WordPress Core Remote File Inclusion Vulnerability, to its Known Exploited Vulnerabilities catalog. Federal civilian agencies were given until September 28 to fix it.

The 15-minute owner check

You don't need a developer to find out whether you're patched. You need an admin login, five minutes in the dashboard and a clear answer on who controls your hosting.

How do you update WordPress safely?

Take a backup, apply the security release for your branch, then test the pages that bring in business. For a patch release like this one, that usually takes minutes.

• Back up files and the database first, and download a copy or confirm it's stored off the server.
• On a simple brochure site, update from Dashboard > Updates. WordPress's own post says sites that support automatic background updates will start the process themselves.
• On a heavily customized site, or one where someone edited WordPress core files directly, apply the update on a staging copy first. Many hosts offer one-click staging.
• After updating, test the contact form, booking flow, phone click-to-call, checkout if you have one, and the pages your ads point to.
• If a plugin or theme breaks, don't roll WordPress back to 7.1.1. Deactivate the plugin that broke, or switch temporarily to a default theme, and fix the plugin. Going back to the vulnerable version is the one option that's off the table.

Updated but already hacked: signs you were hit before you patched

An update closes the door. It doesn't remove anything an attacker left inside while the door was open.

• Administrator accounts you don't recognize, or familiar accounts whose email address changed.
• PHP files in `wp-content/uploads`, which should normally hold images and documents.
• Recently modified files in the theme or plugin folders that nobody on your side touched.
• Visitors, especially on phones or arriving from Google, being redirected to other sites.
• Pages you didn't write showing up in a `site:yourdomain.com` Google search, often pharmacy, casino or replica-goods spam in other languages.
• A warning in Google Search Console's Security Issues report, or an email from your host about malware or unusual outbound mail.

After the patch: what hardening actually helps?

Hardening won't stop the next core vulnerability, but it limits what an attacker can do and how long a compromise goes unnoticed.

• Least-privilege accounts: one administrator per real person, editors for people who only publish, and no shared logins.
• Turn off the dashboard file editor by adding `define( 'DISALLOW_FILE_EDIT', true );` to `wp-config.php`. The guide notes this stops code edits through the dashboard but won't stop file uploads.
• A web application firewall, either at your host, through a CDN, or from a security vendor. Patchstack says its customers were covered by a mitigation rule for this CVE.
• Off-site, dated backups you have restored at least once, so you know they work.
• Automatic security updates left on. Most small-business sites are far safer auto-patched than waiting for a human to notice.

Does your maintenance plan really exist?

A maintenance plan is only real if someone can tell you, with dates, when your site was last updated, backed up and checked.

• Which WordPress version is the site on right now, and when was 7.1.2 or the branch fix applied?
• Are automatic security updates on? If not, why not, and who applies them?
• When was the last backup, where is it stored, and when did anyone last test a restore?
• Did you check for signs of compromise after this CVE, or only apply the update?
• Who has admin and hosting access today, and can you send me a list?
• If the site were hacked tomorrow, what does our plan include and what costs extra?

When should you get help?

Frequently asked questions