WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
WordPress patched critical CVE-2026-87902 (CVSS 9.2), an unauthenticated flaw that can execute code on some servers.
WordPress released 7.1.2 on September 22, 2026, fixing CVE-2026-87902, a critical unauthenticated flaw rated CVSS 9.2. Supported branches from 4.7 through 7.1.1 are affected, including sites patched on September 17. The bug can make a site load a PHP file outside its theme folders; attacker-controlled code execution further depends on theme structure and PHP settings such as register_argc_argv. There is no workaround, no public proof of concept, and no reported exploitation.
- CVE-2026-87902 is rated CVSS 9.2 and needs no account.
- Versions 4.7.0 through 7.1.1 are affected; fixed builds include 7.1.2.
- Code execution also depends on theme layout and PHP settings.
- No attacks, public exploit, or CISA KEV entry reported on September 22.
- CVEs
- CVE-2026-87902
- Vendors
- WordPress
- Products
- WordPress
- Organizations
- Patchstack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
From the original article
2 min read at thehackernews.com
WordPress has fixed a critical flaw in its core software that lets an attacker with no account make a site load a PHP file from outside its theme folders. On some servers, that can go further, allowing the attacker to run their own code. The fix shipped on September 22 in WordPress 7.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.