Column 1
Skip to content

WordPress 7.1.2 Security Update: Patch and Verify Your Site

September 23, 2026

WordPress 7.1.2 is a security release that WordPress recommends installing immediately. It fixes a critical vulnerability tracked as CVE-2026-87902. WordPress says the most serious outcome requires particular server and theme conditions, so do not assume every site is exposed in the same way. Do not wait to check: confirm the installed core version and plan the update now.

What site owners should know

The official release notice describes a critical security fix and says eligible older branches are receiving backports as those packages become ready. It does not say that every WordPress site has been attacked. This is a patching and verification task, not a reason to run untrusted tests against a live site.

Start with your WordPress dashboard or managed host panel. Record the installed core version, the active theme, and any pending plugin or PHP compatibility notices. If your host handles automatic core updates, confirm the completed version rather than assuming the job has run. For a site held on an older branch, check the exact branch’s fixed release before marking it protected.

Update without losing your recovery path

  1. Confirm a usable recovery point. Check that the normal backup or host restore service has a recent recovery point and that the restore process is understood. A successful job notification is not the same as a tested restore. See our WordPress backup verification guide.
  2. Choose a short maintenance window. Tell the people responsible for publishing, forms, bookings, or orders when validation will occur. Use staging for sites with custom themes, complex plugins, or critical transactions. Our update-window checklist covers that preparation.
  3. Install the official update. Use the WordPress Updates screen or your managed host’s supported update path. Avoid third-party packages or emergency code changes that have not been reviewed.
  4. Verify the installed version and visitor paths. Recheck core version in the dashboard. Visit the public homepage and representative posts, sign in to the editor, submit a test form, and test checkout or booking flows where they exist. Check mobile rendering and any multilingual or member-only paths that matter to your site.
  5. Clear caches and watch for errors. Purge the site’s normal page cache and CDN cache when the update is complete. Review your host’s application and security alerts for unexpected errors, then document the version and test results for the site owner.

If the update cannot be completed yet

Escalate the version and compatibility blocker to the host or site maintainer promptly. Keep existing security controls enabled and limit unnecessary administrative access while preparing the supported update path. Do not treat a firewall rule, a lack of visible errors, or an unverified backport as proof that core is patched. If you suspect compromise, preserve the normal incident records and have an authorized responder review the site before making broad changes.

Need help planning the update or checking the result? Start with Fix I.T. Phill WordPress support. For the release and its current branch guidance, use the official WordPress 7.1.2 announcement.