WordPress 7.1.2 Patches Critical RCE Vulnerability

WordPress has issued an urgent security update, version 7.1.2, to patch a critical vulnerability that poses a significant risk to websites running the popular content management system. The vulnerability, identified as CVE-2026-87902, allows unauthenticated attackers to achieve remote code execution (RCE) under specific conditions.

The flaw stems from an issue in how WordPress resolves page templates. According to security researchers, an attacker can exploit this by manipulating the template resolution process to include local PHP files that reside outside the active theme's directory. If the server environment and the website's active theme meet certain prerequisites, this could lead to the execution of arbitrary code on the server.

This RCE vulnerability is particularly concerning due to its potential impact. A successful exploit could allow an attacker to take full control of a compromised WordPress site, leading to data theft, website defacement, the installation of malware, or the use of the server for further malicious activities. The fact that it can be exploited by unauthenticated attackers significantly lowers the barrier to entry for malicious actors.

The WordPress security team has thanked Robert Ressl for responsibly disclosing the vulnerability. This proactive disclosure allowed the core development team to develop and release a patch before the vulnerability could be widely exploited in the wild. Users are strongly advised to update their WordPress installations immediately to mitigate this risk.

The update is available for download from WordPress.org, and users can also initiate the update directly from their WordPress Dashboard by navigating to "Updates" and clicking "Update Now." For sites configured with automatic background updates, the process should commence automatically. The release notes also highlight that the security fix is being backported to supported older branches of WordPress, including versions up to 4.7, ensuring a broader range of users can benefit from the patch.

This release was led by John Blackbourn and involved contributions from a large team of WordPress contributors, underscoring the collaborative effort involved in maintaining the security of the platform. The advisory also includes references to CVE-2026-87902 and GHSA-7hp8-65ch-5whp for those seeking more technical details.

While the backporting process is underway for older branches, WordPress emphasizes that only the most recent version is actively supported. The ongoing efforts to patch vulnerabilities across different versions demonstrate the commitment to securing the vast WordPress ecosystem, which powers a significant portion of the internet's websites.

This critical patch serves as a reminder of the constant need for vigilance in maintaining website security. Regular updates, robust security practices, and prompt patching of newly discovered vulnerabilities are essential for protecting websites from evolving cyber threats.

This new article provides a deeper technical dive into CVE-2026-87902, detailing the specific vulnerability within the get_page_template() function and the insufficient validation of the pagename query variable. It further elaborates on the conditions required for exploitation, including the presence of specific theme structures and the register_argc_argv PHP setting, and explains the two-part fix implemented in WordPress 7.1.2.

This new advisory details a critical flaw in WordPress core, identified as CVE-2026-87902 with a CVSS score of 9.2, which allows unauthenticated attackers to load PHP files from outside the theme directory. While previous reports focused on broader RCE vulnerabilities in WordPress plugins or other software, this specific core vulnerability requires specific server configurations and theme structures to achieve arbitrary code execution, and WordPress has released version 7.1.2 to address it.

Attackers have been observed actively probing WordPress sites for CVE-2026-87902, a critical local file inclusion vulnerability, within five hours of the patch release. This rapid response suggests threat actors likely analyzed the patch diff to develop exploitation techniques. The probes target core WordPress files like wp-links-opml.php to confirm vulnerability, employing double-encoded traversal payloads and requiring a valid page_id parameter for successful reconnaissance.

This new report from Wordfence provides deeper technical analysis of CVE-2026-87902, detailing how the path traversal vulnerability within the locate_template() function can lead to remote code execution under specific theme and server conditions. It also highlights that while the vulnerability is in WordPress Core, exploitation requires a specific theme directory structure and a readable PHP file on the server, offering more granular insight into the actual risk beyond the critical CVSS score.

This new report details the specific mechanism of CVE-2026-87902, explaining how attackers can manipulate WordPress's page template resolution to include and execute local PHP files outside the theme directory. It also highlights that exploitation is possible without authentication and depends on specific server configurations and the presence of readable PHP files outside standard theme locations.

The new WordPress 7.1.2 release specifically addresses CVE-2026-87902, a critical unauthenticated path traversal vulnerability. This flaw allows attackers to load arbitrary PHP files from outside theme directories, potentially leading to remote code execution on affected servers running versions 4.7.0 through 7.1.1. The vulnerability has been rated 9.2 out of 10 on the CVSS scale, emphasizing its severity and the immediate need for patching.

Exploitation of CVE-2026-87902, a critical path traversal vulnerability in WordPress, began within hours of its public disclosure, escalating to active compromises by September 23rd. Security firm Patchstack observed attackers first verifying vulnerability, then checking for PEAR's pearcmd.php inclusion, and finally abusing it for RCE. The initial exploitation activity was designed for reconnaissance but quickly moved to active compromises, with traffic volumes increasing significantly and reaching a wider spread of sites.

Threat actors began exploiting CVE-2026-87902 within hours of its public disclosure on September 22, 2026, the same day patches were released. Exploitation attempts, observed by security firms like Previdian and Patchstack, involve including the pearcmd.php file to write malicious PHP scripts to temporary directories, enabling remote code execution.

The exploitation of CVE-2026-87902 has evolved beyond simple reconnaissance, with attackers now actively attempting to write malicious PHP files to vulnerable servers. This progression is facilitated by targeting the PEAR utility, pearcmd.php, which, when combined with the local file inclusion flaw, can lead to remote code execution. The observed activity includes the creation of files in temporary directories like /tmp and /var/tmp, with filenames such as wp-pear-rce-flag.php, indicating a clear intent to establish persistence or execute further malicious commands.