CVE-2026-87902: WordPress Template RCE Risk

CVE-2026-87902: WordPress Template RCE Risk | 2026

Executive Summary

Since September 22, 2026, the critical CVE-2026-87902 vulnerability in WordPress has become an urgent patch event for site owners and hosting teams. The flaw affects WordPress 4.7.0 through 7.1.1, carries a CVSS 9.2 score, and can let an unauthenticated attacker force page-template resolution to include a readable local PHP file outside the active theme directories.

The worst-case impact is conditional remote code execution. WordPress describes the issue as dependent on server and theme preconditions, but the risk is serious enough that the project shipped WordPress 7.1.2 and backported fixes to every eligible branch down to 4.7.37. That means a site updated to the September 17 WordPress 7.1.1 security release still needs a new update.

There are no public reports of exploitation, no public proof-of-concept, and no CISA Known Exploited Vulnerabilities listing as of September 22. Still, defenders should treat this as a same-day update because the weakness sits in core template loading, requires no account, and can become code execution on systems that meet the right file-system and PHP configuration conditions.

---

The Flaw: Template Path Traversal to Local PHP Inclusion

CVE-2026-87902 is a critical-severity path traversal and local file inclusion vulnerability in WordPress page-template resolution (CVSS 9.2). The vulnerable behavior allows an unauthenticated attacker to influence how get_page_template() resolves a page template and include a chosen readable local .php file outside the active theme directories.

The issue matters because PHP inclusion is not just file reading. If WordPress includes a local PHP file, that file executes in the application context. Whether this becomes attacker-controlled code execution depends on preconditions, but those preconditions are realistic enough for WordPress and GitHub to classify the advisory as critical.

How the Exploit Works

1. Target a vulnerable WordPress site: The attacker sends a crafted request to a site running WordPress 4.7.0 through 7.1.1 or an affected older branch build.
2. Influence page-template resolution: The crafted page name reaches template selection logic that previously did not consistently reject traversal patterns.
3. Escape the intended theme path: A ../ style path can point resolution toward a readable local PHP file outside the active theme directories.
4. Trigger PHP inclusion: If the file exists and the path shape fits the active theme condition, WordPress can load that PHP file.
5. Reach conditional RCE: On servers with a useful local PHP target, such as the known pearcmd.php technique when register_argc_argv is enabled, inclusion can become arbitrary code execution.

Unauthenticated request
  -> crafted page name / template candidate
  -> get_page_template() resolution
  -> traversal toward readable local PHP file
  -> PHP include
  -> conditional remote code execution

The patch -- WordPress 7.1.2, released September 22, 2026 -- addresses this by restricting path traversal in locate_template() and validating that resolved template paths stay inside allowed theme or compatibility directories. However, sites on older supported branches must install their matching backported release rather than assume 7.1.1 is enough.

---

Timeline: When Was CVE-2026-87902 Patched?

Date	Event	Status
September 17, 2026	WordPress released 7.1.1 for separate maintenance and security fixes	Earlier patch
September 22, 2026	WordPress released 7.1.2 for a critical security vulnerability	Patch available
September 22, 2026	GitHub advisory GHSA-7hp8-65ch-5whp published affected and patched branches	Public disclosure
September 22, 2026	WordPress Trac changeset 63792 restricted traversal in locate_template()	Fix detail
September 22, 2026	The Hacker News reported no public exploitation, PoC, or KEV listing at publication time	Monitoring

---

Affected and Fixed Versions

The mainline fix is WordPress 7.1.2. WordPress also backported the security patch to older eligible branches.

Branch	Affected versions	Fixed version
7.1	7.1.0 - 7.1.1	7.1.2
7.0	7.0.0 - 7.0.5	7.0.6
6.9	6.9.0 - 6.9.8	6.9.9
6.8	6.8.0 - 6.8.9	6.8.10
6.7	6.7.0 - 6.7.8	6.7.9
6.6	6.6.0 - 6.6.8	6.6.9
Older supported branches	4.7.0 and later branch releases	Matching backport through 4.7.37

Sites running automatic background security updates should receive the fix automatically where the update process is working. Manual sites, managed hosting fleets, and custom deployment pipelines should verify the exact installed version.

---

Why This Matters: WordPress Core Bugs Move Fast

WordPress powers a large share of public websites, which changes the operational risk of a core exploit. Even a conditional vulnerability can become attractive quickly because attackers can scan for version exposure, theme structure, PHP settings, and reachable targets at internet scale.

The key nuance is that CVE-2026-87902 is not guaranteed full takeover on every site. The GitHub advisory lists two important preconditions for code execution: the active parent or child theme must contain a top-level directory whose name starts with page-, and the server must expose a readable local PHP file that can be useful when included. GitHub specifically notes legacy Twenty Twelve and Twenty Fourteen themes, as well as popular third-party themes such as Neve, Hestia, and Sydney, as examples of the first condition.

That nuance should not slow patching. Preconditions are not mitigations. They are triage context. A site that does not meet the known worst-case chain today may still be exposed to local file inclusion behavior, future technique improvements, or environment-specific paths that defenders have not modeled.

Key Challenges

1. Core reachability: The vulnerable behavior is in WordPress core, not a single plugin that can be disabled.
2. No authentication required: The advisory lists privileges required as none and user interaction as none.
3. Environment-dependent impact: Theme layout and PHP configuration influence exploitability, making risk easy to underestimate.
4. Recent patch confusion: Sites updated to WordPress 7.1.1 on September 17 still require the September 22 patch.

---

Defensive Posture: Immediate Actions for WordPress Teams

Critical Priority: Patch Core

• Update WordPress immediately to 7.1.2 on the 7.1 branch.
• Use the matching backport if you operate an older supported branch, such as 7.0.6, 6.9.9, 6.8.10, or the relevant release down to 4.7.37.
• Verify the installed version after the update, especially on fleets using managed hosting, staging-to-production promotion, or custom deployment jobs.
• Do not treat 7.1.1 as current for this issue; it fixed a different set of vulnerabilities.

Exposure Review

• Identify active themes that include top-level folders beginning with page-, such as page-templates.
• Check whether legacy default themes or popular third-party themes named in the advisory are active on any production sites.
• Review PHP configuration for register_argc_argv, particularly on older PHP versions and cPanel-style environments.
• Ask hosting providers whether automatic security updates completed successfully across all WordPress instances.

Detection and Response

• Review web server logs for unusual page-name requests, encoded traversal patterns, and repeated probing around page templates.
• Monitor for requests containing ../, double encoding, unusual page- path fragments, or unexpected PHP file names.
• Check for newly modified theme files, unexpected PHP files, altered .htaccess rules, new administrator accounts, and suspicious cron jobs.
• If suspicious requests reached a vulnerable site before patching, handle the review as incident response, not just maintenance.

index=web sourcetype=access_combined
("..%2f" OR "%2e%2e" OR "../" OR "page-" OR "pearcmd.php")
| stats count min(_time) as firstSeen max(_time) as lastSeen by src_ip, host, uri_path, uri_query, status
| sort - count

W3CIISLog
| where TimeGenerated > ago(14d)
| where csUriQuery has_any ("..%2f", "%2e%2e", "../", "page-", "pearcmd.php")
   or csUriStem has_any ("..%2f", "%2e%2e", "../", "page-", "pearcmd.php")
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
  by cIP, sSiteName, csUriStem, csUriQuery, scStatus
| order by Count desc

These queries are starting points. Tune them for your logging format, normalize URL decoding where possible, and correlate hits with WordPress version, theme, PHP settings, and file-system changes.

---

Bottom Line

CVE-2026-87902 is a critical WordPress core issue where the right theme and server conditions can turn unauthenticated template traversal into PHP code execution.

Key Takeaways

• Patch now - WordPress 7.1.2 and branch backports are available.
• Do not rely on 7.1.1 - the September 17 update does not fix this separate flaw.
• Check preconditions - themes with page- directories and PHP settings such as register_argc_argv help prioritize deeper review.
• Look for probing - absence of a public PoC does not mean attackers will wait.

For Your Clients and Users

Update WordPress core today and verify the deployed version on every site. If a site was internet-facing on an affected version, review logs and theme/server conditions before closing the ticket.

---

References

1. https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html
2. https://es.wordpress.org/2026/09/22/wordpress-7-1-2-actualizacion-de-seguridad/
3. https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
4. https://core.trac.wordpress.org/changeset/63792
5. https://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-core-7-1-1-unauthenticated-local-file-inclusion-to-remote-code-execution-vulnerability