This security release features a fix for a critical severity security vulnerability.<\/p>\n
Because this is a security release, it is recommended that you update your sites immediately.<\/strong><\/p>\n You can download WordPress 7.1.2 from WordPress.org<\/a>, or visit your WordPress Dashboard, click \u201cUpdates\u201d, and then click \u201cUpdate Now\u201d. If you have sites that support automatic background updates, the update process will begin automatically.<\/p>\n The security team would like to thank Robert Ressl<\/a> for responsibly disclosing that an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to remote code execution (RCE).<\/p>\n This release was led by John Blackbourn<\/a>. WordPress 7.1.2 would not have been possible without the contributions of the following people:<\/p>\n Aaron Jorbin<\/a>, Aki Hamano<\/a>, Alex Concha<\/a>, Ehtisham Siddiqui<\/a>, fiocavallari<\/a>, Jb Audras<\/a>, Jeffrey Paul<\/a>, Jeremy Felt<\/a>, Joe McGill<\/a>, John Blackbourn<\/a>, Lance Willett<\/a>, Manuel Camargo<\/a>, marcs0h<\/a>, martin.krcho<\/a>, Mukesh Panchal<\/a>, Olga Gleckler<\/a>, Pascal Birchler<\/a>, Peter Wilson<\/a>, Rajin Sharwar<\/a>, Ressl<\/a>, Shail Mehta<\/a>, Stephanie Walters<\/a>, and vortfu<\/a>.<\/p>\n Further details can be found in the advisory: CVE-2026-87902 \/ GHSA-7hp8-65ch-5whp<\/a>.<\/p>\n As a courtesy, the security fix is being backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported<\/strong>. The backports are in progress and will ship as they become ready.<\/p>\n","protected":false},"excerpt":{"rendered":" This security release features a fix for a critical severity security vulnerability. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.2 from WordPress.org, or visit your WordPress Dashboard, click \u0645\u0632\u06cc\u062f \u067e\u0691\u06be\u06cc\u06ba<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2747","post","type-post","status-publish","format-standard","hentry","category-pakistan"],"_links":{"self":[{"href":"https:\/\/mailurdu.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/2747","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mailurdu.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mailurdu.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mailurdu.co.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mailurdu.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2747"}],"version-history":[{"count":0,"href":"https:\/\/mailurdu.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/2747\/revisions"}],"wp:attachment":[{"href":"https:\/\/mailurdu.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2747"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mailurdu.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2747"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mailurdu.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2747"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Security update included in this release<\/h2>\n
Thank you to these WordPress contributors<\/h2>\n
CVE and GHSA references<\/h2>\n
Backports<\/h2>\n