This security release features a fix for a critical severity security vulnerability.
Because this is a security release, it is recommended that you update your sites immediately.
You can download WordPress 7.1.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. [All applicable clients of ProtectYourWP.com have already been updated.] If you have sites that support automatic background updates, the update process will begin automatically.
Security update included in this release
The security team would like to thank Robert Ressl for responsibly disclosing that an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to remote code execution (RCE).
Source: https://wordpress.org/news/2026/09/wordpress-7-1-2-release/