On September 22, 2026, the WordPress Security Team released an emergency update (WordPress 7.1.2) to patch a severe security flaw known as a “critical unauthenticated path traversal vulnerability”.
More details: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
In simple terms, this vulnerability could allow unauthorized individuals—even those without an account or login—to trick your website into revealing sensitive local files. If a site uses a specific theme directory structure, this flaw can give hackers a path to execute malicious code and take over the website.
For a business owner, the risk is straightforward: leaving this unpatched means an attacker could bypass your security walls, steal sensitive data, or hijack your online store without you ever realizing how they got in. Updating the WordPress core is critical to close that backdoor and keep your business safe.
The Good News: We Have Already Protected You If your online store is currently managed by FinestShops team, we have already proactively updated your WordPress core to the secure 7.1.2 version (or the appropriate secure backport for your specific setup). We handled this immediately after the vulnerability was disclosed, so your site remains secure and operational with no downtime on your end.
How to Verify Your WordPress Version:
We always encourage our clients to feel confident in their site’s security. You can easily verify that your store is running the patched software by following these steps:
- Log in to your WordPress admin area.
-
On the main “Dashboard” screen, locate the “At a Glance” box.
-
It will display your current version (it should read WordPress 7.1.2 or list a secure backport version).
-
Alternatively, you can navigate to Dashboard > Updates in the left-hand menu, where your current version will be listed at the top of the page.
If you check your dashboard and see an older version of WordPress, or if you need assistance safely updating your plugins to ensure they remain fully compatible with this new security patch, please contact our support team immediately. We will handle the technical heavy lifting so you can focus on running your business.
You don’t have to upgrade to 7.1.2, but you must at least install the branch-specific hotfix.
Below is the list of branches and the version to upgrade:
7.1.0 through 7.1.1 -> 7.1.2
7.0.0 through 7.0.5 -> 7.0.6
6.9.0 through 6.9.8 -> 6.9.9
6.8.0 through 6.8.9 -> 6.8.10
6.7.0 through 6.7.8 -> 6.7.9
6.6.0 through 6.6.8 -> 6.6.9
6.5.0 through 6.5.11 -> 6.5.12
6.4.0 through 6.4.11 -> 6.4.12
6.3.0 through 6.3.11 -> 6.3.12
6.2.0 through 6.2.12 -> 6.2.13
6.1.0 through 6.1.13 -> 6.1.14
6.0.0 through 6.0.15 -> 6.0.16
5.9.0 through 5.9.17 -> 5.9.18
5.8.0 through 5.8.16 -> 5.8.17
5.7.0 through 5.7.18 -> 5.7.19
5.6.0 through 5.6.20 -> 5.6.21
5.5.0 through 5.5.21 -> 5.5.22
5.4.0 through 5.4.22 -> 5.4.23
5.3.0 through 5.3.24 -> 5.3.25
5.2.0 through 5.2.27 -> 5.2.28
5.1.0 through 5.1.25 -> 5.1.26
5.0.0 through 5.0.28 -> 5.0.29
4.9.0 through 4.9.32 -> 4.9.33
4.8.0 through 4.8.31 -> 4.8.32
4.7.0 through 4.7.36 -> 4.7.37
To do this, install the plugin “WP Downgrade | Specific Core Version” and enter the core subversion to install. For example, if you are updating the core from 6.8.2, enter “6.8.10” and update the core.
To Your Success!
Anton Pachkine @ finestshops.com
