WordPress 7.1.2 was released on September 22, 2026 as a security release. The WordPress project said it fixed a critical-severity vulnerability and recommended updating immediately. Its advisory described a template-resolution issue that could, under specific server and theme conditions, let an unauthenticated attacker include a readable local PHP file and potentially achieve remote code execution. The project also backported the fix to eligible branches through 4.7. Exact availability depends on the branch a site runs.

What to check

  1. Open Dashboard → Updates and identify the site’s current branch and version.
  2. Check the official WordPress version and release information for that branch.
  3. Back up the site and apply the current supported update through your usual workflow.
  4. Confirm the dashboard reports the updated version and test key site features.

Do not assume that an older branch receives the same fixes or support as the current major branch. WordPress notes that its current version is actively supported; older branches may receive selected backports. Use the specific release notes to determine whether your version is covered and plan to move to a supported release where compatible.

This is a summary of September’s release history, not a statement about your particular site’s update status.

Source