WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

WordPress released version 7.1.2 to fix a critical flaw that lets an unauthenticated attacker make the software load a PHP file of the attacker’s choosing from outside the site’s active theme folders. On sites where the server and the active theme meet certain conditions, the attacker can go on to run code on the server.

The project tracks the flaw as CVE-2026-87902 and lists every release from 4.7.0 through 7.1.1 as affected. The attacker needs no account on the site and no action from anyone who has one.

Because this is a security release, it is recommended that you update your sites immediately.

What the bug does

The bug sits in get_page_template(), the function WordPress uses to pick the theme file that renders a page. An attacker can steer that lookup to a readable .php file elsewhere on the server. This is a path traversal bug, meaning the request walks out of the directory the code expected to stay in. WordPress then includes the file, and PHP runs the code inside it.

WordPress rated the flaw 9.2 out of 10 on version 4 of CVSS, the common scale for vulnerability severity. The score assumes an attacker working over the network, with low complexity, no privileges and no user interaction.

Who gets the patch

The fix ships in 7.1.2 and in 24 older branches, from 7.0.6 down to 4.7.37. Sites that accept automatic background updates will start the update on their own, and others can update from the Updates screen in the Dashboard.

“As a courtesy, the security fix was backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported,” WordPress noted.