Critical WordPress Flaw Lets Unauthenticated Attackers Execute Remote Code
WordPress 7.1.2 patches a critical CVSS 9.2 path traversal flaw (CVE-2026-87902) that could allow unauthenticated RCE under specific theme and server configurations.
WordPress has released version 7.1.2 to address a critical path traversal vulnerability, CVE-2026-87902, which could allow unauthenticated remote code execution under specific conditions. The flaw, with a CVSS v4 score of 9.2, stems from improper page-template resolution and affects WordPress versions from 4.7 onwards. Successful exploitation requires the active theme to have a top-level directory starting with 'page-' and a readable local PHP file accessible to the web server. Patches have been backported to older supported branches.
- WordPress version 7.1.2 patches a critical path traversal vulnerability (CVE-2026-87902) that can lead to unauthenticated RCE.
- The CVSS v4 score is 9.2, and the flaw affects versions dating back to WordPress 4.7.
- Exploitation is conditional, requiring specific server configurations and the presence of a 'page-*' directory in the active theme.
- Patched versions have been released for all supported WordPress branches.
- CVEs
- CVE-2026-87902
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87902 | Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2) | 8.1 | 96% | KEVPoC ×23 | KEV |
From the original article
2 min read at gbhackers.com
WordPress has released version 7. 1. 2 to address a critical path-traversal vulnerability, tracked as CVE-2026-87902, which could allow unauthenticated remote code execution (RCE) under specific server and theme configurations.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.