WordPress 7.1.2 is a security update, not a feature upgrade to postpone until the next redesign. Install the current official patched release and verify the code actually serving your site. A completed task in a hosting dashboard is useful evidence, but it is not a substitute for checking the deployed installation.
The September 22 announcement describes a critical page-template resolution vulnerability that can lead to code execution when particular theme and server conditions are met. This does not mean every affected site has been exploited. It does mean a site looking normal is not a reason to skip the update.
Identify the Installation Before Updating
Record the production domain, hosting account, WordPress path, installed version, active theme, and person responsible for deployment. Agencies should include inactive-looking public installations and temporary migration domains in their inventory. An old staging copy is still a separate system if it is reachable.
For a single-site operator, the first check is Dashboard > Updates. For a developer with authorized shell access, read the installed version in the correct directory:
wp core version
That command reports the local copy, not all containers, servers, or deployment artifacts. If your host runs multiple nodes, ask how the update reaches each one. Avoid declaring the whole service patched from one successful terminal session.
Apply the Trusted Update, Then Verify It
Use the official dashboard updater, your managed host's supported workflow, or your existing deployment process. Make sure a recent, usable backup exists and preserve the current database before a repair. Do not spend hours designing an elaborate test environment while an urgent patch remains unapplied; ask the host for a supported emergency rollout when needed.
Check the installed version again after deployment. Then compare core files against the official package with WP-CLI's checksum command:
wp core verify-checksums
Investigate failures with the correct version and locale before replacing files. Never suppress certificate validation to make this check pass. A checksum success covers the official core files it checks, not plugins, uploads, accounts, database content, or proof that no intrusion occurred. The core-integrity runbook explains that boundary.
Explanatory worksheet. Fill in your own evidence; no customer results are represented.
Separate Patch Evidence From Recovery Evidence
Use a short record with one row per live installation. Mark the deployment as complete only when the expected version and integrity result are documented. Mark business recovery separately after testing public pages, administrator access, a controlled form submission, and any checkout path affected by the change.
| Evidence |
What it supports |
What it does not establish |
| Installed version |
Which local release is present |
Every other node is updated |
| Core checksum result |
Official core-file parity |
Entire site is malware-free |
| Deployment record |
Who changed which artifact |
Customer workflows succeeded |
| Controlled workflow test |
That particular journey works |
All extensions are compatible |
Use synthetic test details and avoid triggering live payments or customer notifications. If an error appears, preserve its timestamp and exact message. Do not restore the vulnerable package as an unattended long-term workaround.
What About Older WordPress Branches?
The release documentation lists branch-specific backports. Check that live list instead of assuming every branch uses the number 7.1.2. A backport is not a promise of full ongoing support for an old branch. Plan the supported upgrade separately if a legacy dependency prevents it today.
If suspicious file changes or unknown administrator activity are already present, preserve logs and get incident help alongside patching. Applying a security update does not remove an attacker's existing access. Ask HandL WP to investigate the affected installation with the version evidence, redacted errors, and the deployment paths you have checked.
Sources and release details checked September 24, 2026. Diagrams are explanatory; examples are synthetic.