Critical WordPress Core Vulnerability Lets Attackers Execute Code Without Logging In
WordPress 7.1.2 patches a critical unauthenticated remote code execution flaw (CVE-2026-87902) in the core template resolution mechanism.
WordPress has released version 7.1.2 to patch a critical unauthenticated remote code execution vulnerability, CVE-2026-87902. The flaw, disclosed by security researcher Robert Ressl, exists in the page template resolution mechanism and could allow an attacker to include and execute a readable local PHP file outside the active theme directory. Successful exploitation depends on server configuration and the active theme but does not require authentication, making exposed and unpatched sites a high-priority target. WordPress administrators are urged to update immediately, as the fix has been backported through version 4.7.
- WordPress 7.1.2 patches a critical unauthenticated RCE vulnerability, CVE-2026-87902.
- The flaw affects template resolution, allowing local PHP file inclusion.
- Exploitation depends on server config and active theme but requires no authentication.
- Attackers could deploy web shells, steal credentials, or modify website content.
- The fix is backported to WordPress branches through version 4.7.
- CVEs
- CVE-2026-87902
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
From the original article
2 min read at cybersecuritynews.com
WordPress has released version 7. 1. 2 to address a critical security vulnerability that could allow unauthenticated attackers to execute code on vulnerable websites under specific conditions.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.