WordPress shipped two updates in five days this month. Version 7.1.1 arrived on 17 September with 47 fixes, 11 of them for security. Version 7.1.2 followed on 22 September to close a single hole that the WordPress security team rated critical.
If your site is still on 7.1 or 7.1.1, update it today. This post explains what each release fixed and why the second one matters most.
WordPress 7.1.1: a maintenance and security release
On paper, 7.1.1 is a routine point release. In practice it carries a lot of security work: 17 bug fixes for WordPress core, 19 for the block editor and 11 security fixes. The security fixes include:
- Two stored cross-site scripting (XSS) flaws. One in
wpautop()allowed scripts to be slipped in through comments. The other affected themes that support custom headers. - An authenticated path traversal flaw in the REST API templates controller.
- A flaw that let users with Contributor access or above overwrite posts they had no right to edit.
- Specially crafted URLs that could make WordPress install and preview an inactive theme from WordPress.org.
- Several information leaks, including the titles of private parent posts and the slugs of draft and pending posts.
- A flaw that let any logged-in user move comments under a different parent.
Most of these need the attacker to have an account on your site, or to trick someone who does. That lowers the risk on a brochure site with one administrator. It raises the risk on membership, e-learning and WooCommerce sites, where customers and students all have logins.
The full list, with credits, is in the WordPress 7.1.1 release announcement.
WordPress 7.1.2: one critical fix
Version 7.1.2 fixes one issue, and it is a serious one. The WordPress security team describes it like this: an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If the server environment and the active theme meet the right pre-conditions, this can lead to remote code execution.
In plain English, someone with no login could get a vulnerable site to run code of their choosing. That is about as bad as a website flaw gets. With remote code execution, an attacker can do anything your site can do: create admin accounts, plant malware, redirect your visitors or copy your database.
Robert Ressl reported the flaw, and it is tracked as CVE-2026-87902. The advice in the WordPress 7.1.2 release announcement is blunt: “Because this is a security release, it is recommended that you update your sites immediately.”
“Under certain conditions” means not every site will be exploitable. Don’t bet your business on being one of the lucky ones. Once a fix is public, anyone can compare the old and new code to see what changed, and automated scans for unpatched sites usually follow soon after.
The fix has also been backported to every older branch that still receives security updates, back to WordPress 4.7. If you run an older major version, there is a patched release for your branch. Only the latest version of WordPress is actively supported, so treat that as a stopgap, not a plan.
Why every update matters
Each WordPress release tells attackers where the weak spots were. A site left on an old version gets less safe every week, because the list of published flaws that apply to it keeps growing.
Plenty of sites fall behind. Research published by Censys in July found that only 14% of publicly visible WordPress sites were running the current version. We covered that in 86% of WordPress sites are running outdated software.
WordPress installs minor releases like 7.1.1 and 7.1.2 automatically by default, so why do so many sites lag? Some hosts and developers switch automatic updates off. Some updates fail quietly because of file permissions or a scheduled task that never runs. And core is only part of the job. Plugins and themes need the same attention, and that is where most WordPress vulnerabilities turn up.
How to check your own site
- Log in to WordPress and go to Dashboard > Updates. The page shows which version you are running.
- If it shows anything earlier than 7.1.2, take a backup, then click Update to version 7.1.2.
- Once it finishes, check your key pages and forms still work.
WP Support Agency clients: nothing to do
If we look after your site, you don’t need to lift a finger. Applying WordPress core updates is part of our maintenance service, alongside plugin and theme updates, backups and monitoring. Both 7.1.1 and 7.1.2 have been applied to every site we manage.
If you have a question about your own site, get in touch and you will speak to someone who knows it.
Not a client yet? Watching for releases like these, testing them and applying them is the routine work our hosting, maintenance and support plans take off your plate. Not sure where your site stands today? Request a free website review and we will tell you, in plain English, what needs attention.
References
- WordPress 7.1.1 Maintenance and Security Release, WordPress News, 17 September 2026
- WordPress 7.1.2 Release, WordPress News, 22 September 2026