WordPress core's page-template resolution in get_page_template() contains an unauthenticated local file inclusion flaw (CWE-98): a remote attacker with no account can influence which template file WordPress includes, causing it to load a chosen readable local .php file from outside the active theme directories. If certain pre-conditions hold on both the server and the active theme — most notably the existence of an attacker-readable .php file on disk, such as content in an uploads directory — the included file's code executes, escalating the LFI to full remote code execution over the site (CVSS 8.1, high impact to confidentiality, integrity, and availability). The high attack-complexity rating reflects these pre-conditions, but successful exploitation requires no privileges and no user interaction. All sites running WordPress core versions prior to the 7.1.2 security release are affected and should treat this as a priority patch. The issue is fixed in WordPress 7.1.2; there is no public proof of concept, it is not in the CISA KEV catalog, and no exploitation in the wild is currently known.
What to do: Update to WordPress 7.1.2 immediately via Dashboard → Updates (or WP-CLI), and enable automatic updates for security releases so future fixes land without delay. As defense-in-depth against the LFI-to-RCE path, block PHP execution in wp-content/uploads and any other web-writable directories at the web-server level, since RCE depends on including a readable .php file. Afterwards, audit uploads and web logs for unexpected .php files and anomalous template-selection requests.
Affected
WordPress (WordPress.org) WordPress core
All versions prior to 7.1.2
Estimated exposure
massorder of hundreds of millions of sites (WordPress powers roughly 40%+ of all websites) — This is a WordPress core flaw, so effectively every unpatched self-hosted WordPress installation worldwide is theoretically in scope; WordPress's ~40%+ share of all websites (per public market trackers like W3Techs) puts the base…
Description
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
CISA Known Exploited Vulnerability
Affected
WordPress Core
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Attackers are exploiting WordPress LFI CVE-2026-87902 to write malicious PHP and seek remote code execution.
Patchstack says attackers are actively exploiting CVE-2026-87902, an unauthenticated local file inclusion in WordPress page-template handling with CVSS 9.2. The flaw affects WordPress Core 4.7.0 through 7.1.1 and is fixed in 7.1.2 plus backports including 7.0.6, 6.9.9, 6.8.10, and 4.7.37. Exploitation began on September 22, 2026, and progressed within a day to using PEAR’s pearcmd.php to write PHP files under /tmp and /var/tmp, a chain that can yield remote code execution. Automated Nuclei and public proof-of-concept scanning is now hitting large numbers of sites.
WordPress patched critical unauthenticated RCE CVE-2026-87902 in 7.1.2; attackers weaponized pearcmd.php within hours of disclosure.
WordPress 7.1.2 fixes CVE-2026-87902 (CVSS 9.2), where an unauthenticated attacker can make page template resolution include an arbitrary local PHP file outside theme directories, leading to RCE, with fixes backported to version 4.7. Patchstack telemetry shows reconnaissance within five hours of the September 22 release and full exploitation within about a day, with attackers abusing pearcmd.php to write malicious PHP to /tmp before loading it via the flaw. Traffic volume increased roughly tenfold in a day as scanning shifted to payload delivery, and public scanning tooling for the CVE is in circulation.
Threat actors actively exploit critical WordPress CVE-2026-87902 (RCE) shortly after its disclosure, with confirmed exploitation attempts.
Threat actors actively exploit critical WordPress vulnerability CVE-2026-87902 (CVSS 9.2, RCE) within hours of public disclosure, with confirmed exploitation attempts targeting the platform.
Attackers are exploiting critical WordPress flaw CVE-2026-87902 for unauthenticated code execution.
Attackers are exploiting CVE-2026-87902, a critical unauthenticated path-traversal flaw in WordPress that can lead to remote code execution when certain theme and PHP conditions are met. WordPress scored it 9.2 and patched it in 7.1.2, backporting fixes through the 4.7 branch; versions before 4.6 remain unfixed. Patchstack said reconnaissance began within hours of the September 22 patch and later traffic shifted to writing PHP files that run shell commands. Site owners should update and check logs.
Attackers began exploiting critical WordPress path-traversal CVE-2026-87902 for remote code execution within hours of disclosure.
Patchstack says exploitation of WordPress CVE-2026-87902, a CVSS 9.2 path-traversal flaw in page-template resolution, started within hours of disclosure and reached active compromises by September 23. Unauthenticated attackers can include a chosen local PHP file and, when theme and server preconditions are met, reach remote code execution, including via pearcmd.php when register_argc_argv is enabled. WordPress patched the issue in version 7.1.2 on September 22 and backported the fix through the 4.7.x line. Attack traffic later ran at more than ten times the first evening's volume and progressed from vulnerability checks to PHP writes.
WordPress before 7.1.2 is under active attack via CVE-2026-87902, an unauthenticated path traversal that can yield remote code execution.
The Canadian Centre for Cyber Security issued advisory AV26-952 on September 23, 2026, for WordPress versions before 7.1.2. CVE-2026-87902 is an unauthenticated path traversal in page-template resolution that can lead to conditional remote code execution. Open-source reporting indicates the vulnerability is being exploited in the wild. The centre urges administrators to review the linked WordPress materials and apply updates.
Attackers probed unauthenticated WordPress LFI CVE-2026-87902 within hours of the 7.1.2 patch.
Patchstack reports active probing of CVE-2026-87902, an unauthenticated local file inclusion in WordPress page template resolution, rated CVSS 9.2. The flaw affects WordPress 4.7.0 through 7.1.1 and is fixed in 7.1.2, 7.0.6, 6.9.9, 6.8.10, and backports to 4.7.37. First probes arrived at 17:44 UTC on 22 September 2026, under five hours after the patch, using double-encoded traversal that matches the diff. Observed requests only include core files such as wp-links-opml.php as an oracle and have not yet targeted code-execution paths such as pearcmd.php.
WordPress 7.1.2 patches a critical CVSS 9.2 path traversal flaw (CVE-2026-87902) that could allow unauthenticated RCE under specific theme and server configurations.
WordPress has released version 7.1.2 to address a critical path traversal vulnerability, CVE-2026-87902, which could allow unauthenticated remote code execution under specific conditions. The flaw, with a CVSS v4 score of 9.2, stems from improper page-template resolution and affects WordPress versions from 4.7 onwards. Successful exploitation requires the active theme to have a top-level directory starting with 'page-' and a readable local PHP file accessible to the web server. Patches have been backported to older supported branches.
WordPress 7.1.2 patches a critical unauthenticated remote code execution flaw (CVE-2026-87902) in the core template resolution mechanism.
WordPress has released version 7.1.2 to patch a critical unauthenticated remote code execution vulnerability, CVE-2026-87902. The flaw, disclosed by security researcher Robert Ressl, exists in the page template resolution mechanism and could allow an attacker to include and execute a readable local PHP file outside the active theme directory. Successful exploitation depends on server configuration and the active theme but does not require authentication, making exposed and unpatched sites a high-priority target. WordPress administrators are urged to update immediately, as the fix has been backported through version 4.7.
CISA added actively exploited WordPress Core flaw CVE-2026-87902 to the Known Exploited Vulnerabilities catalog.
CISA added WordPress Core flaw CVE-2026-87902, CVSS 9.2, to its Known Exploited Vulnerabilities catalog. An unauthenticated attacker can make get_page_template() include a readable local PHP file outside the active theme, and under specific server and theme conditions that can become remote code execution. The vulnerability is being exploited, with attackers using pearcmd.php to write malicious PHP and run code. WordPress 7.1.2 fixes the bug, present since 4.7.0, and CISA directed federal agencies to remediate it by September 24, 2026.
WordPress 7.1.2 fixes a critical unauthenticated path traversal flaw (CVE-2026-87902) that could allow remote code execution.
WordPress released version 7.1.2 to address a critical unauthenticated path traversal vulnerability (CVE-2026-87902). The flaw allows an attacker to load and execute arbitrary PHP files from outside the site's active theme folders, potentially leading to remote code execution. All WordPress versions from 4.7.0 through 7.1.1 are affected, and users should update immediately.
Critical WordPress file inclusion flaw (CVE-2026-87902) allows RCE and has been present since version 4.7.0.
WordPress 7.1.2 addresses a critical (CVSS 9.2) unauthenticated file inclusion vulnerability, CVE-2026-87902, which has existed since version 4.7.0. The flaw in the `get_page_template()` function allows remote code execution under specific conditions, including a theme with a 'page-' folder and a PHP environment with `register_argc_argv` enabled. The patch not only closes the direct hole but also adds a new function, `_wp_is_template_path_allowed()`, for broader template path validation.
WordPress 7.1.2 patches critical unauthenticated local file inclusion that can lead to remote code execution.
WordPress 7.1.2 fixes CVE-2026-87902, a critical flaw disclosed by Robert Ressl. Under certain server and theme conditions, an unauthenticated attacker can make page template resolution include a chosen readable local PHP file outside the active theme, potentially leading to remote code execution. The fix is being backported to security-supported branches through WordPress 4.7. Sites should update immediately; automatic background updates will apply where enabled.
CISA added actively exploited WordPress Core remote file inclusion CVE-2026-87902 to the KEV catalog.
CISA added CVE-2026-87902, a WordPress Core remote file inclusion vulnerability, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. CISA says this class of flaw is a frequent attack vector and a significant risk to the federal enterprise. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV-listed high-risk vulnerabilities on exposed assets. CISA urges all organizations to remediate KEV entries using risk-based vulnerability management.
WordPress patched critical CVE-2026-87902 (CVSS 9.2), an unauthenticated flaw that can execute code on some servers.
WordPress released 7.1.2 on September 22, 2026, fixing CVE-2026-87902, a critical unauthenticated flaw rated CVSS 9.2. Supported branches from 4.7 through 7.1.1 are affected, including sites patched on September 17. The bug can make a site load a PHP file outside its theme folders; attacker-controlled code execution further depends on theme structure and PHP settings such as register_argc_argv. There is no workaround, no public proof of concept, and no reported exploitation.
WordPress 7.1.2 fixes unauthenticated LFI CVE-2026-87902 that can reach remote code execution.
WordPress 7.1.2, released 22 September 2026, is a security-only update for CVE-2026-87902, an unauthenticated local file inclusion in page template resolution reported by Robert Ressl. The flaw affects WordPress core from 4.7.0 through 7.1.1, is CWE-98, and has a CVSS 4.0 score of 9.2. File inclusion can become remote code execution when a useful PHP file such as PEAR pearcmd.php is readable and register_argc_argv is enabled, a common default in official PHP Docker images and older cPanel PHP. The fix adds the missing validate_file check and a template path containment check; Patchstack did not publish a working request.
WordPress patches CVE-2026-87902, an unauthenticated path traversal that can enable conditional remote code execution.
WordPress security updates address CVE-2026-87902, described as a severe unauthenticated path traversal in the page-template resolution mechanism. The weakness can enable conditional remote code execution. The report does not say the flaw is being exploited in the wild.