This security release features a fix for a critical severity security vulnerability.<\/p>\n
Because this is a security release, it is recommended that you update your sites immediately.<\/strong><\/p>\n You can download WordPress 7.1.2 from WordPress.org<\/a>, or visit your WordPress Dashboard, click \u201cUpdates\u201d, and then click \u201cUpdate Now\u201d. If you have sites that support automatic background updates, the update process will begin automatically.<\/p>\n The security team would like to thank Robert Ressl<\/a> for responsibly disclosing that an unauthenticated attacker can, under certain conditions, make page template resolution include a chosen readable local PHP file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to remote code execution (RCE).<\/p>\n This release was led by John Blackbourn<\/a>. WordPress 7.1.2 would not have been possible without the contributions of the following people:<\/p>\n Aaron Jorbin<\/a>, Aki Hamano<\/a>, Alex Concha<\/a>, Ehtisham Siddiqui<\/a>, fiocavallari<\/a>, Jb Audras<\/a>, Jeffrey Paul<\/a>, Jeremy Felt<\/a>, Joe McGill<\/a>, John Blackbourn<\/a>, Lance Willett<\/a>, Manuel Camargo<\/a>, marcs0h<\/a>, martin.krcho<\/a>, Mukesh Panchal<\/a>, Olga Gleckler<\/a>, Pascal Birchler<\/a>, Peter Wilson<\/a>, Rajin Sharwar<\/a>, Ressl<\/a>, Rudy Faile<\/a>, Shail Mehta<\/a>, Stephanie Walters<\/a>, and vortfu<\/a>.<\/p>\nSecurity update included in this release<\/h2>\n
Thank you to these WordPress contributors<\/h2>\n
CVE and GHSA references<\/h2>\n