Critical WordPress Core Vulnerability Lets Attackers Execute Code Without Logging In

WordPress has released version 7.1.2 to address a critical security vulnerability that could allow unauthenticated attackers to execute code on vulnerable websites under specific conditions.

Site administrators should update immediately because successful exploitation may not require attackers to log in or have a valid WordPress account.

The flaw is tracked as CVE-2026-87902, and it affects WordPress page template resolution, a core mechanism that determines which PHP template file renders a requested page.

Security researcher Robert Ressl responsibly disclosed the issue to the WordPress security team. The vulnerability can allow a remote attacker to influence template resolution and cause WordPress to include a readable local PHP file located outside the active theme directory.

Under normal circumstances, WordPress is expected to load page templates only from trusted theme locations. The vulnerability creates a path that may allow an attacker to select a local PHP file that should not be available through the theme rendering process.

WordPress Core Vulnerability

If the affected server configuration and active WordPress theme meet the required preconditions, including a chosen local PHP file, it can result in remote code execution. This means an attacker could potentially run malicious PHP code on the underlying web server without authenticating to the WordPress site.

Remote code execution vulnerabilities are among the most serious issues affecting content management systems. A successful attack could enable threat actors to deploy web shells, steal database credentials, modify website content, create administrator accounts, redirect visitors, distribute malware, or use the compromised server to target other systems.

The security release does not indicate that every WordPress installation is exploitable. Exploitation depends on the server environment, the active theme, and whether relevant readable PHP files are present outside the active theme directories.

However, the attack does not require authentication, making exposed and unpatched sites a high-priority target for automated internet scanning and opportunistic exploitation.

WordPress recommends that administrators update all sites to version 7.1.2 immediately. Users can download the latest package from the official WordPress website or install the update through the WordPress Dashboard by selecting Updates and clicking Update Now. Sites configured for automatic background updates may receive the patch automatically.

The vulnerability fix has also been backported to WordPress branches eligible for security fixes, currently extending through version 4.7. While this gives older deployments a mitigation path, WordPress noted that only the latest release is actively supported.

Administrators should verify that updates completed successfully, confirm that all sites are running a patched release, and review web-server and WordPress logs for suspicious requests involving template paths, unexpected PHP execution, or newly created administrative users. Security teams should also inspect active themes and custom code that modify template selection behavior.

Organizations operating public-facing WordPress sites should treat CVE-2026-87902 as an urgent patching requirement. The combination of unauthenticated access and potential remote code execution makes rapid remediation essential for preventing full site and server compromise.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC