WordPress CVE-2026-87902: Critical Vulnerability, Update to 7.1.2 Immediately

WordPress Vulnerability CVE-2026-87902: Critical Patch

The vulnerability is tracked as CVE-2026-87902 and has been assessed by the WordPress security team with a 9.2 out of 10 score on the CVSS v4 scale. This indicates a critical severity level with low attack complexity and no requirement for user authentication or interaction.

On September 22, WordPress released version 7.1.2, which fixes a critical security vulnerability that allows an unauthenticated attacker to cause the software to load a PHP file of the attacker's choosing from outside the active theme directories. Under certain server and theme configuration scenarios, an attacker can also achieve remote code execution on the server.

What's Broken

The vulnerability exists in WordPress core's template file selection function, which determines which theme file to render when displaying a page. The bug is in the get_page_template() function, which WordPress uses to select the theme file that renders a page. An attacker can redirect this search to a readable .php file elsewhere on the server.

This is a path traversal vulnerability: the request escapes the directory where the code should remain, and WordPress then includes this file, while PHP executes the code within it.

Security researcher Roberts Ressls, who discovered and privately reported the vulnerability through the HackerOne program, explains that the core vulnerability is local PHP file inclusion via an unauthenticated frontend request.

In the proof-of-concept chain from inclusion to arbitrary PHP code execution he demonstrated, PEAR components that were already available in the tested server environment were used. Since PEAR is not a WordPress dependency, this attack vector is not available on every deployment. This means actual code execution (RCE) is not guaranteed on every site, but the file inclusion itself is possible practically everywhere the vulnerability hasn't been patched.

Independent security research confirms the mechanism in simpler terms:

an attacker sends an anonymous request with two public values, pagename and page_id. The page_id points to a legitimately published page, so WordPress serves it normally. The pagename value, containing doubly-encoded path traversal, remains in the request.

Which Versions Are Affected

The WordPress project considers all versions from 4.7.0 through 7.1.1 to be affected, meaning virtually all WordPress installations in use today that haven't been updated promptly.

The Fix

The patch is provided in version 7.1.2, as well as 24 older branches, starting from 7.0.6 back to 4.7.37. Sites with automatic background updates enabled will begin updating automatically, while others will need to do so from the "Updates" section of the admin panel.

The WordPress security team emphasizes that because this is a security release, sites should update immediately.

The situation is particularly urgent because the vulnerability is already being exploited in the wild. Security firm Patchstack reports that attack attempts were observed on the same day the patch was released, with the first observed activity logged on September 22, 2026 at 17:44 UTC. This means only a few hours passed between public disclosure and the first attack attempts.

What to Do Now

Update WordPress to 7.1.2 (or the corresponding security release for your branch) immediately—this is the most critical action.
If immediate updating isn't possible, consider server-level mitigation measures as recommended by security researchers, such as WAF/RapidMitigate-type rules.
Review your server and WordPress logs for unusual requests containing the pagename parameter with encoded path traversal characters.
Ensure automatic background updates are enabled going forward for faster remediation of similar incidents.

Note: This article describes the vulnerability for informational and defensive purposes only, based on publicly available security reports. It does not include exploitation steps or code.

Sources: