Mautic 7.1.2: what was fixed and how to prepare for the upgrade

Mautic 7.1.2 was released on 28 May 2026. It fixes seven vulnerabilities, so the upgrade should not be delayed. Before deploying it, however, prepare a backup, tests and a rollback plan.

Author: Patryk GruszkaPublished: 21 July 2026Topic: Mautic security

What Mautic 7.1.2 fixes

The release fixes seven vulnerabilities: SQL injection in API contact filtering, SSRF in the Focus component, SSTI in theme templates, path traversal during campaign import, an authorization bypass in API v2 endpoints, and two stored XSS vulnerabilities related to the Projects component.

Not every vulnerability is necessarily reachable in every installation. That depends, among other things, on the features in use, user permissions, API exposure, custom themes and integrations. This is not, however, a reason to postpone the upgrade without assessing the environment.

How to prepare for the upgrade

Perform the upgrade in a test environment first, especially if the installation uses custom plugins or integrations.

  1. Record the Mautic, PHP and database versions, as well as the plugins and integrations in use.
  2. Back up the database, files and configuration. Verify that the backup can be restored.
  3. Perform the upgrade in a test environment with outbound messages disabled.
  4. Check campaigns, forms, API, integrations, cron jobs, queues and logs.
  5. Upgrade production during an agreed maintenance window, repeat the tests and monitor the system.

ELTS for Mautic 4.4 installations

If you cannot yet move from Mautic 4.4 to a supported version, you can enrol the installation in the paid Extended Long Term Support (ELTS) programme. It provides security fixes for the Mautic core and officially supported plugins until 31 December 2026. ELTS gives you additional time to prepare the migration, but it does not replace it.

My contribution to the release

I coordinated the Mautic 7.1.2 release as Release Leader. I prepared the fix for the SSRF vulnerability in the Focus component and reviewed fixes for the remaining vulnerabilities. Details are available in the official Mautic 7.1.2 release notes.

When to start with an assessment

If you do not know the full history of the installation, have many custom plugins, or are unsure whether the backup can be restored, first establish the technical state and prepare a work plan.

Sources

← All writing