WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE
WordPress 7.1.2 fixes unauthenticated LFI CVE-2026-87902 that can reach remote code execution.
WordPress 7.1.2, released 22 September 2026, is a security-only update for CVE-2026-87902, an unauthenticated local file inclusion in page template resolution reported by Robert Ressl. The flaw affects WordPress core from 4.7.0 through 7.1.1, is CWE-98, and has a CVSS 4.0 score of 9.2. File inclusion can become remote code execution when a useful PHP file such as PEAR pearcmd.php is readable and register_argc_argv is enabled, a common default in official PHP Docker images and older cPanel PHP. The fix adds the missing validate_file check and a template path containment check; Patchstack did not publish a working request.
- CVE-2026-87902 affects WordPress 4.7.0 through 7.1.1.
- Unauthenticated local file inclusion scores CVSS 4.0 9.2.
- Remote code execution depends on includable PHP and register_argc_argv.
- WordPress 7.1.2 adds validation and template path containment checks.
- Patchstack did not publish a working request and urges updates.
- CVEs
- CVE-2026-87902
- Vendors
- WordPress
- Products
- WordPress
- Organizations
- PatchstackWordPress
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
From the original article
4 min read at patchstack.com
WordPress 7. 1. 2 landed on 22 September 2026.
patchstack.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.