WordPress released version 7.1.2 on September 22, 2026 to patch CVE-2026-87902, a critical, unauthenticated file inclusion flaw in how core resolves page templates. It carries a CVSS score of 9.2, affects every release from 4.7.0 through 7.1.1, and can lead to remote code execution on servers with certain PHP configurations. Attackers were already probing live sites for it within five hours of the patch going out.
What CVE-2026-87902 Actually Does
The bug sits in WordPress’s get_page_template() logic. According to WordPress’s own release announcement, an unauthenticated attacker can, under certain conditions, make page template resolution include a readable local PHP file from outside the active theme’s directory. Security researcher Robert Ressl reported the issue responsibly, and Patchstack’s writeup breaks down the mechanics: the exploit sends a request with a valid page_id alongside a double-encoded directory traversal sequence in the pagename parameter. WordPress’s sanitization preserves the escaped characters and only decodes them later, during template lookup, which lets the traversal slip past the initial filter.
No login is required. Depending on server configuration, a successful hit can go beyond reading arbitrary local files to actually executing code.
Who Needs to Act, and How Fast
Anyone running a WordPress install anywhere between 4.7.0 and 7.1.1 is affected, which is close to every WordPress site currently online that hasn’t already updated. WordPress backported the fix unusually far back, all the way to 4.7.37, alongside point releases 7.0.6, 6.9.9 and 6.8.10 for sites still on older branches.
Patchstack recorded the first probing traffic at 17:44 UTC on September 22, less than five hours after the patch shipped. The requests so far are reconnaissance, not payload delivery: scanners hitting core files like wp-links-opml.php, wp-includes/functions.php and wp-cron.php to fingerprint which hosts are still vulnerable. That window closes fast once a working exploit chain starts circulating publicly.
What to Do Right Now
- Update to 7.1.2 (or the matching point release for your branch) immediately if auto-updates haven’t already applied it.
- Check server logs for requests combining
page_idandpagenameparameters, especially with%252e%252etraversal sequences, since that combination rarely shows up in normal traffic. - Watch for unexpected OPML output or raw PHP source appearing on what should be a normal page URL.
This is separate from the Click2Shell theme-installation bug WordPress patched a few days earlier in 7.1.1, so updating for one doesn’t cover the other; sites need to be current on 7.1.2 specifically. For agencies managing a portfolio of client sites, this is exactly the kind of release where staying current across every install matters more than the individual fix itself. ConicPlex’s WordPress Development work includes keeping core and plugin versions current for clients so a patch like this doesn’t sit unapplied for days while sites get scanned.
