This safety launch includes a fix for a critical intensity security susceptability.
Since this is a protection release, it is advised that you upgrade your sites instantly.
You can download WordPress 7 1 2 from WordPress.org , or visit your WordPress Control panel, click “Updates”, and after that click “Update Now”. If you have websites that sustain automatic history updates, the upgrade procedure will certainly start instantly.
Protection update consisted of in this launch
The security team would love to thank Robert Ressl for properly divulging that an unauthenticated opponent can, under specific conditions, make page design template resolution include a selected understandable neighborhood PHP data outside the active theme directory sites. If appropriate pre-conditions for both the web server environment and the active theme are fulfilled, this can lead to remote code execution (RCE).
Thanks to these WordPress contributors
This release was led by John Blackbourn WordPress 7 1 2 would not have been possible without the payments of the complying with individuals:
Aaron Jorbin , Aki Hamano , Alex Concha , Ehtisham Siddiqui , fiocavallari , Jb Audras , Jeffrey Paul , Jeremy Felt , Joe McGill , John Blackbourn , Jon Surrell , Lance Willett , Manuel Camargo , marcs0h , martin.krcho , Mukesh Panchal , Olga Gleckler , Pascal Birchler , Peter Wilson , Rajin Sharwar , Ressl , Rudy Faile , Sergey Biryukov , Shail Mehta , Stephanie Walters , and vortfu
CVE and GHSA references
More information can be found in the advisory: CVE- 2026 – 87902/ GHSA- 7 hp 8 – 65 ch- 5 whp
Backports
As a politeness, the security repair was backported to all branches eligible to get safety and security repairs (presently via 47 As a pointer, just one of the most current variation of WordPress is actively sustained
