WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

WordPress released version 7.1.2 to fix a critical flaw that lets an unauthenticated attacker make the software load a PHP file of the attacker’s choosing from outside the site’s active theme folders. On sites where the server and the active theme meet certain conditions, the attacker can go on to run code on the server.

The project tracks the flaw as CVE-2026-87902 and lists every release from 4.7.0 through 7.1.1 as affected. The attacker needs no account on the site and no action from anyone who has one.

Because this is a security release, it is recommended that you update your sites immediately.

What the bug does

The bug sits in get_page_template(), the function WordPress uses to pick the theme file that renders a page. An attacker can steer that lookup to a readable .php file elsewhere on the server. This is a path traversal bug, meaning the request walks out of the directory the code expected to stay in. WordPress then includes the file, and PHP runs the code inside it.

WordPress rated the flaw 9.2 out of 10 on version 4 of CVSS, the common scale for vulnerability severity. The score assumes an attacker working over the network, with low complexity, no privileges and no user interaction.

Who gets the patch

The fix ships in 7.1.2 and in 24 older branches, from 7.0.6 down to 4.7.37. Sites that accept automatic background updates will start the update on their own, and others can update from the Updates screen in the Dashboard.

“As a courtesy, the security fix was backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported,” WordPress noted.

UPDATE (September 24, 2026, 05:30 a.m. ET):

Researchers and attackers are probing WP sites, looking for ones vulnerable to CVE-2026-87902 exploitation.

“[On September 22], every request we had seen was reconnaissance against harmless core files. That is no longer true. Attackers are now including pearcmd.php and using it to write PHP files to disk, and public scanning tooling for this CVE is in circulation,” WordPress security company Patchstack observed.

“Traffic against this CVE is now running at more than ten times the volume we saw on the first evening, it is reaching a far wider spread of sites.”