WordPress 7.1.2: What Changed and Should Website Owners Update?

Key Takeaway

• WordPress 7.1.2, released September 22, fixes a critical security issue. WordPress recommends updating immediately.
• The September 17 release, 7.1.1, addressed 11 other security issues plus maintenance bugs. It is no longer the latest version.
• Check the version actually running on each site. An automatic update setting is not proof that an update finished.
• Back up your files and database, update through the dashboard or your host, and test important pages and forms afterward.

Introduction

WordPress 7.1.1 arrived on September 17 with security and maintenance fixes. Five days later, WordPress 7.1.2 added a fix for a separate critical security issue. 

For website owners deciding what to install, the answer has changed: 7.1.2 is the current release as of September 23. 

The practical task is to check your site's installed version, update promptly, and confirm that the site still works afterward.

What did WordPress 7.1.2 fix?

WordPress announced 7.1.2 on September 22 as a security release addressing one critical-severity vulnerability. 

Its description is specific: under certain server and active-theme conditions, an unauthenticated attacker could make page-template resolution include a readable local PHP file outside the theme directories. 

If those conditions are met, the issue could lead to remote code execution. The release does not say that every WordPress site is exploitable.

That distinction matters, but it is not a reason to wait while you investigate whether your setup meets the conditions. WordPress recommends an immediate update, and its download page currently offers 7.1.2. 

Site owners generally cannot confirm exposure from the public release note alone. The safer decision is to install the fixed release and then verify the installed version.

The 7.1.2 version notes also list fixed releases for affected older branches. Those backports help sites that cannot move to the newest branch immediately. 

WordPress nevertheless says only its most recent version is actively supported, so a backport should not become an indefinite upgrade plan.

What changed in WordPress 7.1.1?

The September 17 release announcement describes 11 security fixes and 17 WordPress Core bug fixes. 

The security list covers different kinds of issues, including stored cross-site scripting (XSS), authorization gaps, information disclosure, and a path-traversal issue affecting the REST API templates controller. 

Several have particular conditions or required user roles; the list is not a claim that each issue affects every site in the same way.

The release also addressed Block Editor bugs. WordPress's two official pages disagree on the exact count: the announcement says 19, while the 7.1.1 version notes say 21. Until WordPress reconciles that discrepancy, the useful conclusion is that editor fixes were included, not a precise count.

If you updated to 7.1.1 last week, that update covered the fixes in that release. It did not include the separate vulnerability fixed on September 22. Check again for 7.1.2 rather than assuming last week's update finished the job.

Should every WordPress owner update now?

If you manage a self-hosted WordPress installation, yes: check the running version and apply the current release promptly. 

In the admin area, Dashboard > Updates shows whether a Core update is available. The version is also shown in the dashboard's At a Glance panel and in Tools > Site Health > Info. 

If your host manages Core updates, ask it which version is deployed and when the update was completed.

Minor security releases can install automatically on many sites, but automatic updates depend on the site's configuration and environment. A site with auto-updates enabled can still have a failed or delayed update. 

Verify the installed version on every installation you oversee, including staging and lesser-used sites. Do not rely on a notification that merely says an update was scheduled.

If your site is hosted directly on WordPress.com, its support documentation says it keeps the WordPress software version up to date automatically. That is different from maintaining a separate self-hosted WordPress installation. 

You can still check your site's status and keep an eye on plugins and themes that you manage.

How should you update without disrupting the site?

For a routine Core update, use a short sequence that gives you a recovery path and a way to confirm success.

1. Confirm the current version and responsibility. Check Dashboard > Updates or your host's control panel. If a managed host applies Core updates, coordinate with it rather than starting a parallel manual update.
   
   
2. Make a recoverable backup. WordPress's backup handbook explains that a typical restore needs both files and the database. Confirm that a recent backup exists and that you know how to restore it.
   
   
3. Apply the available update. Use the WordPress dashboard's Update Now action or your host's supported process. WordPress also documents a manual update route for cases where the one-click route fails; follow its complete instructions if you need it.
   
   
4. Check the installed version and key journeys. Reload the Updates screen, then test the homepage, a representative post, navigation, search, and any forms or checkout flows your site uses. A successful update message is useful, but a live-site check catches problems visitors would see.

For a busy or highly customized site, use a staging copy to test theme and plugin compatibility when available. Keep that test brief: the critical security release calls for prompt deployment. If something breaks, use your tested recovery procedure and involve your host or developer. 

Avoid leaving a vulnerable public site on an older Core version while troubleshooting in isolation.

What if you cannot move to 7.1.2 today?

First, check whether your current branch has a security backport. The 7.1.2 version notes list fixed versions for affected branches from 7.0 back through 4.7, while noting that 4.6 and earlier no longer receive security updates. 

Install the fixed version for your branch if a move to 7.1.2 is temporarily blocked, then plan the move to the supported current version.

If an update fails, record the exact error and your installed version before trying again. WordPress's updating documentation covers failed and manual updates. 

Your hosting provider may need to resolve file-permission or environment issues. Do not treat a failed attempt, an enabled auto-update switch, or a pending host ticket as confirmation that the security fix is installed.

Conclusion

WordPress 7.1.1 brought a substantial round of security and maintenance fixes, but 7.1.2 is now the decision that matters for site owners. 

Check the version running on each site, install the current security release or the appropriate fixed backport, and verify both the version and essential site functions. 

If you are sorting out who controls your updates, our guides to how WordPress works and WordPress.com versus WordPress.org provide useful context. Stay tuned to The Wired Kontent for practical, source-checked updates.

Frequently Asked Question

Is WordPress 7.1.1 still the latest version?

No. WordPress released 7.1.2 on September 22, 2026. Check the official download page again before updating, because the current version may change after this article is prepared.

Does WordPress 7.1.2 include the 7.1.1 fixes?

Yes. For sites on the 7.1 branch, 7.1.2 follows 7.1.1 and adds the newer security fix. Updating to the current 7.1.2 release is the relevant action; you do not need to stop at 7.1.1 first through the normal dashboard update path.

How can I tell whether my WordPress security update installed?

Check the installed version in the admin dashboard or Tools > Site Health > Info, then compare it with the official current release. If a host manages the site, request its deployment confirmation. Also test key pages after the update.

Will WordPress 7.1.2 update automatically?

It may on installations that support automatic background updates, but you should verify the result. WordPress's update guidance describes automatic minor releases, while site configuration and hosting can affect whether an update completes.