WordPress 7.1.2 Fixes a Critical Flaw Attackers Are Already Using

WordPress shipped version 7.1.2 on September 22 to fix a flaw it rated as critical. Attackers started probing sites for it the same day. On September 25, the US Cybersecurity and Infrastructure Security Agency added the bug to its list of flaws that are being used in real attacks.

If your business site runs on WordPress, check your version today.

What the Bug Does

The flaw is in how WordPress picks a page template. An attacker who is not logged in could trick WordPress into loading a PHP file from outside the theme folders. Under some server and theme setups, that can let the attacker run their own code on the site.

The bug is tracked as CVE-2026-87902. WordPress credited Robert Ressl with reporting it. The WordPress team said it "is recommended that you update your sites immediately."

[It] is recommended that you update your sites immediately.

How Fast the Attacks Came

Security firm Patchstack published a timeline of the attacks. It saw the first attempts at 11:49 UTC on September 22, the day of the release. File write attempts followed that afternoon. Public scanning tools and the peak of the traffic came on September 23.

Patchstack said full code execution needed two things on the server. One is a PHP tool called PEAR, through a file named pearcmd.php. The other is a PHP setting called register_argc_argv turned on. Attackers tried to drop PHP files into the /tmp and /var/tmp folders.

Which Versions Are Fixed

WordPress backported the fix to every branch that still gets security updates, reaching back to version 4.7. Sites with automatic background updates should get it on their own. Still, it is worth confirming, because automatic updates can fail or be turned off.

The fix came five days after WordPress 7.1.1, released September 17. That update held 11 security fixes on its own, including a stored cross site scripting bug that a visitor could trigger through a comment.

What to Do Now

• Log in to your WordPress dashboard and check the version number.
• If you are not on 7.1.2 or a patched older branch, update now.
• Ask your host whether PEAR and register_argc_argv are exposed on your server.
• Ask your host, or your web person, to check /tmp for PHP files that do not belong there.

WordPress says its next major release, 7.2, is planned for December.