A critical vulnerability in WordPress Core was patched in version 7.1.2. The flaw, tracked as CVE-2026-87902, can allow an unauthenticated attacker to access PHP files outside the active theme directory and, under certain conditions, execute code on the server.
The official WordPress security advisory gives the vulnerability a CVSS 4.0 score of 9.2, or Critical. WordPress released version 7.1.2 on September 22 and backported the security fix to every release branch from WordPress 7.0 through 4.7.
The issue is more urgent because attackers have already begun targeting it. WordPress security company Patchstack reported that scanning started on September 22 and subsequently progressed to attempts to use the vulnerability to write PHP files to affected servers. Public scanning tools targeting the flaw are also now circulating.
How the WordPress flaw works
CVE-2026-87902 is a path traversal vulnerability in WordPress’s page-template handling. In vulnerable versions, an attacker can manipulate a page name so WordPress’s locate_template() function resolves a PHP file outside the directories where the active theme’s templates are supposed to reside.
No WordPress account or user interaction is required. However, remote code execution is not possible on every vulnerable installation.
According to the WordPress advisory, exploitation requires an active parent or child theme containing a top-level directory whose name begins with page-, such as page-templates. The server must also contain a suitable PHP file that is readable by the web server account.
Those conditions limit when the flaw can be escalated to remote code execution, but they do not eliminate the underlying risk. The vulnerable WordPress code can still be reached without authentication, and whether an attacker can execute code depends on the site’s active theme and server configuration.
WordPress addressed the problem by adding validation to the decoded page name and checking that template paths remain within approved theme directories before WordPress loads them.
Which WordPress versions need updates
The affected versions are branch-specific. WordPress 7.1.0 and 7.1.1 should be updated to 7.1.2, while sites remaining on older release branches need the corresponding September 22 security update.
Patched releases include WordPress 7.0.6, 6.9.9, 6.8.10 and equivalent security releases continuing back to 4.7.37. The complete set of fixed versions is available in the WordPress release archive.
WordPress recommends updating immediately, including on sites configured for automatic background updates. Administrators should confirm that the update actually completed rather than assuming an automatic installation succeeded.
Sites that were exposed before patching should also review server and firewall logs for suspicious requests involving the vulnerable page-template path. Patchstack says attack traffic has moved beyond simple reconnaissance to attempts capable of writing attacker-controlled PHP content to disk, making prompt patching more important than relying solely on firewall rules or the vulnerability’s environmental prerequisites.
Leave a Reply