WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)
WordPress 7.1.2 fixes a critical unauthenticated path traversal flaw (CVE-2026-87902) that could allow remote code execution.
WordPress released version 7.1.2 to address a critical unauthenticated path traversal vulnerability (CVE-2026-87902). The flaw allows an attacker to load and execute arbitrary PHP files from outside the site's active theme folders, potentially leading to remote code execution. All WordPress versions from 4.7.0 through 7.1.1 are affected, and users should update immediately.
- WordPress 7.1.2 fixes a critical unauthenticated path traversal vulnerability (CVE-2026-87902).
- The flaw allows attackers to load and execute arbitrary PHP files from outside the active theme folder.
- All versions from 4.7.0 to 7.1.1 are affected, and immediate updates are recommended.
- CVEs
- CVE-2026-87902
- Products
- ChromeWordPressSharePointChatGPT
- Threat actors
- GTG-1002
- Victims
- artists’ marketplace
- Countries
- China
- AI models
- ChatGPT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
From the original article
1 min read at helpnetsecurity.comWordPress released version 7. 1. 2 to fix a critical flaw that lets an unauthenticated attacker make the software load a PHP file of the attacker’s choosing from outside the site’s active theme folders.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.