WordPress Core file inclusion flaw CVE-2026-87902 exploited; update to 7.1.2 or your branch's fix
WordPress flaw CVE-2026-87902 lets anyone without a login make a site load a chosen PHP file, and can lead to code execution. CISA lists it as exploited. Fixed in 7.1.2 and backports to 4.7. Update WordPress, or ask your web host or developer to.
Update WordPress to 7.1.2, or the fixed release for your branch (for example 7.0.6 or 6.9.9), from the Dashboard under Updates. If someone else runs your site, ask your web host or developer to confirm it has been updated.
What’s happening
CVE-2026-87902 is a flaw in how WordPress Core chooses a page template. An attacker with no account can make a site load a readable PHP file from elsewhere on the server. WordPress published the advisory on 22 September 2026 and released fixed versions the same day, including 7.1.2, 7.0.6 and 6.9.9, with fixes backported to every branch back to 4.7. Every version from 4.7.0 to 7.1.1 is affected. Turning file inclusion into code execution needs two conditions: the active theme has a top-level folder whose name starts with 'page-' (named examples include Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney), and PHP is running with register_argc_argv on, which is the default in the official PHP Docker image and in common cPanel setups before PHP 8.5. CISA listed the flaw as exploited on 25 September 2026. An early report on 23 September had seen no attacks, so the attacks were reported after that. The vendor rates it 9.2 (CVSS v4); CISA's entry says 8.1. Details of the attacks have not been published in the sources read.
- What
- Flaw
- Affects
- WordPress Core (4.7.0 to 7.1.1)
- Affected
- WordPress 4.7.0 through 7.1.1, across all branches (7.1.0–7.1.1, 7.0.0–7.0.5, 6.9.0–6.9.8, 6.8.0–6.8.9, and older branches back to 4.7.0–4.7.36)
- Fixed in
- 7.1.2
7.0.6
6.9.9
6.8.10
6.7.9
6.6.9
6.5.12
6.4.12
6.3.12
6.2.13
6.1.14
6.0.16
5.9.18
4.9.33
4.7.37 - Since
- 22 Sept 2026
- Closed
- 25 Sept 2026
Timeline
- CISA added
CISA listed CVE-2026-87902 among flaws being used in attacks, rating it CVSS 8.1 (the vendor advisory scores it 9.2 on CVSS v4).
- Update
Security Affairs explained the flaw: any affected site can be made to include a local PHP file without login, and code execution needs a theme folder starting with 'page-' plus PHP's register_argc_argv setting. It reported no in-the-wild exploitation at that time.
- Made publicFixed
WordPress published an advisory for CVE-2026-87902 and released fixes, including 7.1.2, 7.0.6 and 6.9.9, backported to every branch back to 4.7. Robert Ressl reported the flaw.
Sources
- Unauthenticated path traversal in page-template resolution leading to conditional RCE (GHSA-7hp8-65ch-5whp)WordPress · 22 Sept 2026
- CVE-2026-87902: how close is your WordPress to remote code execution?Security Affairs · 23 Sept 2026