wordpress 7.1.2 patches a page-template flaw probed within hours
A WordPress core bug let unauthenticated attackers make a site include a local PHP file of their choosing, which can lead to remote code execution when certain server and theme conditions are met. Probing began the same day.
- cve
- CVE-2026-87902
- cvss
- 9.2 (v4.0, WordPress GHSA); 8.1 (v3.1, NVD record)
- affected
- WordPress 4.7.0–7.1.1
- fixed in
- 7.1.2, 7.0.6, 6.9.9, 6.8.10 (backports to 4.7.37)
- exploited
- yes — added to CISA KEV 2026-09-25
- platforms
- self-hosted WordPress on PHP
what happened
- WordPress 7.1.2, released September 22, 2026, fixes CVE-2026-87902, rated critical: an unauthenticated attacker can make page-template resolution include a chosen readable local PHP file from outside the active theme directories. Robert Ressl reported it.[1,2]
- Remote code execution requires an active theme with a top-level directory whose name starts with "page-", including Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney, plus a usable PHP file such as pearcmd.php with register_argc_argv On. The official Docker php image and default cPanel configurations (PHP before 8.5) meet that condition.[2]
- Every branch from 4.7.0 through 7.1.1 is affected. Fixes are 7.1.2, 7.0.6, 6.9.9 and 6.8.10, with backports down to 4.7.37.[2,3]
- Patchstack recorded the first attack attempts at 11:49 UTC on September 22 and the first file-write attempt at 15:34 UTC, using pearcmd.php's +config-create to write PHP files into /tmp and /var/tmp.[5]
- Patchstack said attack traffic on September 23 was more than ten times the first evening's volume and came from a few hundred source IPs.[5]
- CISA added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog on 2026-09-25 with a 2026-09-28 due date.[4,3]
where sources differSeverity scores differ. WordPress's GitHub advisory scores 9.2 (CVSS v4.0, critical), while the NVD record lists 8.1 (CVSS v3.1, high). Patchstack's timeline lists the first pearcmd file-write attempt at 15:34 UTC on September 22, while its first-evening analysis in the same post says that day's traffic was still reconnaissance only.
sources5
- 01WordPress 7.1.2 Release ↗ primaryWordPress.orgaccessed 2026-10-21
- 02Unauthenticated path traversal in page-template resolution leading to conditional RCE (GHSA-7hp8-65ch-5whp) ↗ primaryWordPress (GitHub Security Advisory)accessed 2026-10-21
- 03CVE-2026-87902 (NVD CVE API 2.0 record) ↗ primaryNIST National Vulnerability Databaseaccessed 2026-10-21
- 04CISA Known Exploited Vulnerabilities Catalog (JSON feed, catalogVersion 2026.10.21) ↗ primaryCISAaccessed 2026-10-21
- 05CVE-2026-87902: attackers started probing WordPress sites hours after the patch ↗ secondaryPatchstackaccessed 2026-10-21