WordPress 7.1.2 Patches Critical RCE Vulnerability
WordPress 7.1.2 has been released to address a critical remote code execution vulnerability that could allow unauthenticated attackers to compromise websites.
WordPress has issued an urgent security update, version 7.1.2, to patch a critical vulnerability that poses a significant risk to websites running the popular content management system. The vulnerability, identified as CVE-2026-87902, allows unauthenticated attackers to achieve remote code execution (RCE) under specific conditions.
The flaw stems from an issue in how WordPress resolves page templates. According to security researchers, an attacker can exploit this by manipulating the template resolution process to include local PHP files that reside outside the active theme's directory. If the server environment and the website's active theme meet certain prerequisites, this could lead to the execution of arbitrary code on the server.
This RCE vulnerability is particularly concerning due to its potential impact. A successful exploit could allow an attacker to take full control of a compromised WordPress site, leading to data theft, website defacement, the installation of malware, or the use of the server for further malicious activities. The fact that it can be exploited by unauthenticated attackers significantly lowers the barrier to entry for malicious actors.
The WordPress security team has thanked Robert Ressl for responsibly disclosing the vulnerability. This proactive disclosure allowed the core development team to develop and release a patch before the vulnerability could be widely exploited in the wild. Users are strongly advised to update their WordPress installations immediately to mitigate this risk.
The update is available for download from WordPress.org, and users can also initiate the update directly from their WordPress Dashboard by navigating to "Updates" and clicking "Update Now." For sites configured with automatic background updates, the process should commence automatically. The release notes also highlight that the security fix is being backported to supported older branches of WordPress, including versions up to 4.7, ensuring a broader range of users can benefit from the patch.
This release was led by John Blackbourn and involved contributions from a large team of WordPress contributors, underscoring the collaborative effort involved in maintaining the security of the platform. The advisory also includes references to CVE-2026-87902 and GHSA-7hp8-65ch-5whp for those seeking more technical details.
While the backporting process is underway for older branches, WordPress emphasizes that only the most recent version is actively supported. The ongoing efforts to patch vulnerabilities across different versions demonstrate the commitment to securing the vast WordPress ecosystem, which powers a significant portion of the internet's websites.
This critical patch serves as a reminder of the constant need for vigilance in maintaining website security. Regular updates, robust security practices, and prompt patching of newly discovered vulnerabilities are essential for protecting websites from evolving cyber threats.
This new article provides a deeper technical dive into CVE-2026-87902, detailing the specific vulnerability within the get_page_template() function and the insufficient validation of the pagename query variable. It further elaborates on the conditions required for exploitation, including the presence of specific theme structures and the register_argc_argv PHP setting, and explains the two-part fix implemented in WordPress 7.1.2.