Last week's WordPress 7.1.1 is not this week's 7.1.2

WordPress shipped 7.1.2 yesterday. CVE-2026-87902 is a critical hole in core. No account. No click from an admin. WordPress scored it 9.2. An attacker can make the site load a PHP file from outside the theme folders. On some servers that becomes code running as the web user. Every release from 4.7.0 through 7.1.1 is in. That includes last Thursday's 7.1.1 security drop. If you patched last week and stopped, you are still open.

What last week's update did not cover

September 17 was Click2Shell and Comment2Shell. Different bugs. 7.1.1 closed those. 7.1.2 is this one. WordPress backported it down the supported branches: 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, and courtesy builds back to 4.7.37. Automatic background updates will start it. Everyone else uses the dashboard or the zip from WordPress.org. There is no separate workaround in the project note.

Not every site becomes a full remote shell. WordPress is careful: the worst case needs a second condition on the server, a PHP file that already does something useful when loaded. No reports of use as of yesterday. Not on CISA's list. A public write-up and a test lab exist. We are not going to recap them. The useful fact is the version number.

Why this hits a small Canadian shop

Most Alberta yards and professional offices still run WordPress for the public site, the careers page, or the membership form. Someone clicked Update last Thursday, saw 7.1.1, and closed the ticket. This is the ticket that reopens. Hosts who sell cPanel shares (see this morning's CalDAV-to-root note) now have two jobs: the panel build, and the WP version on every tenant. Toolkit 6.11.3 is the neighbour CVE on that same stack.

What we would check today

• Dashboard, Updates. You want 7.1.2 if you are on 7.1, or the matching number in the table above. Look at the version on the site, not the host's "we auto-update" sentence.
• If you cannot update this morning, that is a ticket, not a shrug. WordPress did not publish a config switch that closes it.
• Do not paste a public proof onto a live site to "validate." The advisory is the reason to patch.
• After the update, you still need yesterday's cPanel and F5 work if those boxes are yours. Zyxel is due tomorrow.

Bottom line

A Thursday security release that is not Friday's security release is how a brochure site stays open. Forensic Five will ask which WordPress number you are on and whether 7.1.1 was the last click. From St. Albert, Alberta. Take 7.1.2. Then go finish the panel and the token box.