WordPress 7.1.2 Fixes a Critical Page-Template Vulnerability

WordPress 7.1.2 fixes a critical page-template vulnerability that can expose sites to unauthenticated local file inclusion under specific theme and server conditions. WordPress recommends updating immediately, including on older supported branches that received backported fixes.

The issue is tracked as GHSA-7hp8-65ch-5whp and CVE-2026-87902, with a CVSS score of 9.2. The WordPress 7.1.2 release post calls it a security release and asks site owners to update. The patch changes the page-template resolution path in wp-includes/template.php.

Patch first, investigate second

Do not postpone the update while trying to prove that a site matches every precondition. The safe order is to capture a backup, install the current maintenance release for the site’s branch, clear caches and run a focused smoke test. Investigation can follow on the patched state.

1. Record the current WordPress core version and take a database plus file backup.
2. Apply WordPress 7.1.2, or the corresponding backport for the supported branch.
3. Confirm the updater changed core successfully and did not leave a partial installation.
4. Purge full-page, object and edge caches.
5. Test representative public pages, logged-in editing and any custom page templates.

If the site cannot update immediately, place a temporary operational control in front of it only as a bridge. A firewall rule or reduced exposure does not replace the core fix.

The vulnerability needs a particular combination

The advisory does not say every WordPress site is directly exploitable. The vulnerable behavior concerns page-template resolution when the active parent or child theme has a top-level directory whose name starts with page-, combined with server and filesystem conditions that allow a chosen readable local PHP file to be included outside the active theme directories.

The advisory names Twenty Twelve, Twenty Fourteen and some third-party themes as examples of theme layouts that can meet the naming condition. A theme match is a reason to prioritize and inspect, not proof that exploitation occurred.

Why local file inclusion is serious

Local file inclusion can make the application execute a readable PHP file that was not intended to be a page template. Depending on what files exist and how the server is configured, the consequence can range from disclosure or application failure to remote code execution.

That is why the CVSS score is high even though exploitation requires conditions. The attacker does not need a WordPress account, and a successful path can cross the normal boundary between theme templates and other local files. This article deliberately omits exploit payloads and request construction; defenders do not need those details to patch and verify.

Older supported branches also received fixes

WordPress shipped 7.1.2 and backported the security change across supported historical branches through the 4.7 line. Sites on 4.6 or earlier are outside the supported range described in the advisory. Updating only a plugin or switching themes is not equivalent to installing the patched core release.

For a managed fleet, inventory by exact core version rather than by major version label. A dashboard that reports “WordPress 6.x” is not precise enough to distinguish a patched maintenance release from a vulnerable one.

Verify the update without turning it into an outage

After patching, use a small, repeatable smoke test:

• request the homepage, one post, one archive, one 404 and one page that uses a custom template;
• confirm status, canonical URL, robots directives and primary rendered content;
• open the editor, save a non-public test draft and preview it;
• review PHP and web-server logs for new fatal errors;
• confirm scheduled backups and monitoring still run.

This overlaps with the WordPress SEO checklist because a security update can also expose template, cache and rendering regressions. The difference is priority: security remediation is the release trigger, while search checks confirm the site stayed healthy after the change.

When to move from maintenance to incident response

A vulnerable version by itself does not prove compromise. Escalate when version exposure appears beside suspicious template requests, unexpected PHP files, modified core files, new administrator accounts, unfamiliar scheduled tasks, web-shell indicators or unexplained outbound connections.

Preserve logs and a filesystem snapshot before cleaning an affected host. Rotate credentials only after establishing a trustworthy recovery path, and avoid destroying evidence that could show when access began. If the site is business-critical or the indicators suggest code execution, involve the hosting provider or an incident-response specialist.

The durable maintenance rule

Core maintenance releases need an owner, a backup target, a staging or smoke-test route and a maximum deployment window. Record the installed version across production, staging and dormant copies because an abandoned subdirectory can remain reachable even when the main site is current.

For this issue, the immediate decision is simple: update to the fixed release for the branch, verify the important routes and review evidence only after the exposure is closed. The advisory’s conditions should improve triage, not become a reason to wait.