Reported by 21 outlets
WordPress 7.1.2 patches a critical WordPress RCE vulnerability (CVE-2026-87902). Update your site to prevent conditional remote code executi
Why this score
- Breadth
- 2.00 / 2.0 · 21 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.36 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Desk analysis
WordPress 7.1.2, released September 22, 2026, fixes CVE-2026-87902, a CVSS v4 9.2 critical unauthenticated path traversal in page-template resolution. Request data reaching get_page_template() can escape the active theme directory and make WordPress include a readable local PHP file of the attacker's choosing. No account, session, or plugin is required. The fix was backported to every maintained branch, with corrected releases from 4.7.37 through 7.1.2, and adds a check that resolved templates stay inside permitted directories, mainly in wp-includes/template.php.
RCE is conditional, not universal. The active parent or child theme must have a top-level directory whose name starts with page-, such as page-templates, and the server must expose a readable PHP file the inclusion can abuse. The demonstrated chain uses PEAR's pearcmd.php when register_argc_argv is On, a known local-file-inclusion-to-RCE path. WordPress notes the official PHP Docker image and default cPanel configurations on PHP below 8.5 meet the conditions. Researcher Robert Ressl disclosed through the WordPress HackerOne program on July 20 and published his PoC and reproducible lab on September 22; his test on WordPress 7.0.2 executed code as www-data.
Exploitation started fast. Patchstack saw the first malicious requests at 17:44 UTC on September 22, under five hours after the patch shipped, initially probing with encoded traversal sequences against core files like wp-links-opml.php, wp-cron.php, wp-login.php, and install.php, then escalating to attempts to write attacker-controlled PHP files to disk. Traffic volume grew roughly tenfold as attacks moved from reconnaissance to payload delivery. Canada's Cyber Centre (AV26-952) and CERT-FR both flagged active exploitation, and Wordfence shipped a firewall rule on disclosure day.
This is close to a worst-case core bug for a CMS running 43 percent of the web: unauthenticated, versions back to 2016-era 4.7 affected, and exploitation observed in the wild within hours. Patch to 7.1.2 or the branch fix immediately, then audit theme directory naming and disable register_argc_argv where possible. Watch for mass scanning tooling, which historically follows within days once conditions are this well documented.
Timeline
-
original reporting
WordPress 7.1.2 patches a critical WordPress RCE vulnerability (CVE-2026-87902). Update your site to prevent conditional remote code executi
securityonline.info · 21d ago · September 22nd, 2026
WordPress 7.1.2 patches a critical WordPress RCE vulnerability (CVE-2026-87902). Update your site to prevent conditional remote code executi
via Mastodon https://securityonline.info/wordpress-rce-vulnerability-cve-2026-87902/?utm_source=mastodon&utm_medium=jetpack_social
-
update from ressl.ch
CVE-2026-87902: Critical WordPress file inclusion and conditional RCE (researcher disclosure write-up)
ressl.ch · 22d ago · September 22nd, 2026
Original researcher disclosure by Robert Ressl, published on advisory day (date-level precision; the site's Atom feed states 2026-09-22T00:00:00Z). Its timeline records private submission through the WordPress HackerOne program on July 20, 2026 at 23:46 UTC, acknowledgment July 21, notice of a planned fix September 15, and publication of his proof-of-concept repository and reproducible lab on September 22. He demonstrated the chain on WordPress 7.0.2 with code executing as www-data, and showed that removing the page-* directory fixture, disabling register_argc_argv, or removing PEAR each broke the chain.
-
update from github.com
Themes: Restrict path traversal in locate_template() (WordPress core fix commit, changeset 63792)
github.com · 21d ago · September 22nd, 2026
The core fix commit, mirroring WordPress SVN changeset 63792, was committed at 12:05:52 UTC on release day, nearly two hours before the advisory published. It modifies wp-includes/template.php, fixes trac ticket #58905, and credits reporter ressl (Robert Ressl) among the contributors. Timestamp taken from the GitHub API commit record.
-
update from github.com
Unauthenticated path traversal in page-template resolution leading to conditional RCE (GHSA-7hp8-65ch-5whp)
github.com · 21d ago · September 22nd, 2026
Vendor security advisory published at 13:57:27 UTC, before most press coverage, listing affected versions 4.7.0 through 7.1.1 and patched releases 4.7.37 through 7.1.2. It spells out the exploitation preconditions: a top-level theme directory starting with page-, and a readable local PHP target such as pearcmd.php when register_argc_argv is On, noting the official php Docker image and default cPanel on PHP below 8.5 are affected. Rates the flaw Critical 9.2 CVSS v4.0, CWE-98, credited to Robert Ressl.
-
update from wordpress.org
WordPress 7.1.2 Release
wordpress.org · 21d ago · September 22nd, 2026
The WordPress Security Team's release announcement for 7.1.2, published at 14:01:20 UTC by John Blackbourn. It thanks Robert Ressl for responsibly disclosing the unauthenticated page-template inclusion flaw, links the CVE-2026-87902 advisory, and states the fix was backported as a courtesy to every branch eligible for security fixes, currently back to 4.7. Publish timestamp taken from the page's article:published_time metadata.
-
update from github.com
WordPress patched a critical unauthenticated path traversal vulnerability (CVE-2026-87902, GHSA-7hp8-65ch-5whp, CVSS 9.2) in its page-templa
github.com · 21d ago · September 22nd, 2026
WordPress patched a critical unauthenticated path traversal vulnerability (CVE-2026-87902, GHSA-7hp8-65ch-5whp, CVSS 9.2) in its page-templa
via Mastodon https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
-
update from malware.news
PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core
malware.news · 21d ago · September 22nd, 2026
The issue is tracked as CVE-2026-87902 and has a CVSS v4.0 score of 9.2 (Critical) . The vulnerability can allow an unauthenticated attacker to make WordPress include a readable PHP file from outside the active theme directory. If the site’s active theme and server environment meet the necessary conditions, the included file can provide a path to remote code execution and complete site compromise. We strongly recommend that all WordPress site owners update immediately and confirm that the update completed successfully. Although exploitation depends on the site’s theme layout and the presence of a suitable local PHP file, the vulnerable behavior is in WordPress Core, requires no account, and can be reached over the internet. Wordfence Premium , Wordfence Care , and Wordfence Response customers received a firewall rule protecting against attacks targeting this vulnerability on September 22, 2026 , the day the vulnerability was disclosed. Wordfence Free users will receive the same protection on
-
update from gbhackers.com
Critical WordPress Flaw Lets Unauthenticated Attackers Execute Remote Code
gbhackers.com · 20d ago · September 23rd, 2026
Critical WordPress Flaw The issue arises from improper page-template resolution […] The post Critical WordPress Flaw Lets Unauthenticated Attackers Execute Remote Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Critical WordPress Core Flaw Lets Unauthenticated Attackers Execute Remote Code
cyberpress.org · 20d ago · September 23rd, 2026
WordPress has released version 7.1.2 to address a critical core vulnerability that could allow unauthenticated attackers to achieve remote code execution under specific server and theme configurations. The issue resides in WordPress page-template resolution, specifically within the get_page_template() functionality. An attacker does not need a WordPress account or any privileges to exploit the flaw. Critical WordPress Core Flaw By manipulating page-template handling, they may be able to cause WordPress to include a readable local PHP file located outside the active theme directory. If the included file can be influenced or already exists in a suitable location, the condition can escalate from a path traversal-style issue to remote code execution. Successful exploitation could enable attackers to run arbitrary PHP code in the context of the affected web server, potentially leading to website takeover, data theft, persistent backdoors, malware deployment, or further movement across a hosting environment. WordPress categorized the flaw as critical because it is remotely reachable and requires no authentication or user interaction. The advisory maps the issue to CWE-98, covering improper control of filenames used in PHP include or require operation
-
update from securityonline.info
An exploited WordPress RCE vulnerability (CVE-2026-87902) is under attack. Details and PoC exploit code are public. Patch your sites now. #
securityonline.info · 20d ago · September 23rd, 2026
Details and PoC exploit code are public. Patch your sites now.
-
update from malware.news
WordPress security advisory (AV26-952)
malware.news · 20d ago · September 23rd, 2026
Serial number: AV26-952 Date: September 23, 2026 As of September 22, 2026, WordPress is affected by a vulnerability in the following product: WordPress Prior to 7.1.2 Open-source reporting indicates that CVE-2026-87902 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
-
update from socprime.com
CVE-2026-87902: Critical WordPress Core Flaw Enables Unauthenticated RCE Under Certain Conditions
socprime.com · 20d ago · September 23rd, 2026
No WordPress account, authentication cookie, administrator interaction, or vulnerable plugin is required for the underlying file-inclusion attack. Remote code execution is conditional rather than universal. Contact Sales CVE-2026-87902 analysis The vulnerability originates in how WordPress Core resolves templates fo
-
update from bleepingcomputer.com
Hackers start exploiting critical WordPress flaw for code execution
bleepingcomputer.com · 20d ago · September 23rd, 2026
Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. Initial attack traffic was only for reconnaissance and started less than five hours after the patch was released in WordPress 7.1.2. Malicious activity increased by ten times, and attackers are now trying to deliver payloads. WordPress security firm Patchstack reports that it observed the first malicious requests at 17:44 UTC on September 22 from a small group of IP addresses targeting multiple sites under its protection.
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-87902: attackers moved from probing to actively exploiting this critical WordPress flaw, writing files to disk that execute shell
www.bleepingcomputer.com · 20d ago · September 23rd, 2026
-
update from cyberpress.org
Hackers Exploit Critical WordPress Flaw to Execute PHP Code on Vulnerable Sites
cyberpress.org · 19d ago · September 24th, 2026
WordPress fixed the issue in version 7.1.2 and released backported patches for supported branches down to 4.7.37. Initial requests focused on confirming whether vulnerable page-template inclusion was possible. Attackers targeted legitimate WordPress core files, including wp-links-opml.php , RSS feed files, wp-cron.php , wp-login.php , and install.php , using encoded traversal sequences within pagename . The attack activity has since progressed to a second stage targeting PEAR’s pearcmd.php , a known local-file-inclusion-to-RCE technique .
-
update from securityweek.com
Critical WordPress Vulnerability Exploited Immediately After Disclosure
securityweek.com · 19d ago · September 24th, 2026
Pearcmd.php provides a command-line tool for the management of PEAR packages in PHP environments and can be abused for RCE on servers with register_argc_argv enabled, especially when combined with a local file inclusion or a path traversal issue. According to WordPress, themes that contain
-
mentioned by cyberworldops.eu
Unauthenticated LFI in WordPress page-template resolution (CVE-2026-87902, CVSS 9.2) is being exploited in the wild. Under specific server a
cyberworldops.eu · 19d ago · September 24th, 2026
-
update from thehackernews.com
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
thehackernews.com · 19d ago · September 24th, 2026
submitted by /u/Vast_Hope_7185 [link] [comments]
via reddit r/cybersecurity: Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
-
update from dev.to
1. Basic Information Original Title: CVE-2026-87902: Attackers Started Probing WordPress... # security # threatintel # software # coding # d
dev.to · 19d ago · September 24th, 2026
security # threatintel # software # coding # d
via Mastodon https://dev.to/anoymask/wordpress-cve-2026-87902-probing-and-php-file-write-attempts-observed-on-patch-day-350m
-
update from theperimetersite.com
CVE-2026-87902 is waking up every WordPress admin who hasn't gone to bed yet. It's a path traversal flaw. That means it goes straight to rem
theperimetersite.com · 19d ago · September 24th, 2026
CVE-2026-87902 is waking up every WordPress admin who hasn't gone to bed yet. That means it goes straight to rem
via Mastodon https://theperimetersite.com/report/298
-
update from www.bleepingcomputer.com
Reward: You've received the Gavel of Mild Competence. Do not squander it. https://www. bleepingcomputer.com/news/secu rity/hackers-start-exp
www.bleepingcomputer.com · 19d ago · September 24th, 2026
Reward: You've received the Gavel of Mild Competence. Do not squander it.
-
mentioned by www.bleepingcomputer.com
Hackers start exploiting critical # WordPress flaw for code execution https://www. bleepingcomputer.com/news/secu rity/hackers-start-exploit
www.bleepingcomputer.com · 19d ago · September 24th, 2026
-
update from go.dhs.gov
We added WordPress Core remote file inclusion vulnerability CVE-2026-87902 to our KEV Catalog. Visit https:// go.dhs.gov/Z3Q & apply mitigat
go.dhs.gov · 18d ago · September 25th, 2026
We added WordPress Core remote file inclusion vulnerability CVE-2026-87902 to our KEV Catalog. Visit https:// go.dhs.gov/Z3Q & apply mitigat
via X https://go.dhs.gov/Z3Q
-
mentioned by cyber.netsecops.io
📰 Critical WordPress Path Traversal Flaw Actively Exploited (CVE-2026-87902) 🚨 CRITICAL VULNERABILITY: WordPress Core is being actively expl
cyber.netsecops.io · 18d ago · September 25th, 2026
-
mentioned by cyber.netsecops.io
📰 Critical WordPress Path Traversal Flaw Actively Exploited (CVE-2026-87902) 🚨 CRITICAL VULNERABILITY: WordPress Core is being actively expl
cyber.netsecops.io · 16d ago · September 27th, 2026
-
mentioned by suriq.io
🔴 EXPLOITED WordPress core CVE-2026-87902 is being exploited to run code on sites, and it affects every release back to 4.7.0. No login need
suriq.io · 16d ago · September 27th, 2026
-
update from en.wikipedia.org
Saw somebody POSTing one of my static pages with a user-agent of “cve-2026-87902-poc/1.0”. I guess this means they've finally implemented th
en.wikipedia.org · 16d ago · September 27th, 2026
Saw somebody POSTing one of my static pages with a user-agent of “cve-2026-87902-poc/1.0”. I guess this means they've finally implemented th
via Mastodon https://en.wikipedia.org/wiki/Evil_bit
-
mentioned by deafnews.it
CVE-2026-87902 is being actively exploited to plant malicious PHP files on WordPress servers within hours. Patching to 7.1.2 won't clean exi
deafnews.it · 16d ago · September 27th, 2026
-
mentioned by cybersecurefox.com
CVE-2026-87902: Critical LFI in WordPress Core 🔗 https:// cybersecurefox.com/en/cve-2026 -87902-critical-lfi-in-wordpress-core # CVE -2026-8
cybersecurefox.com · 15d ago · September 28th, 2026
-
update from www.lemondeinformatique.fr
WordPress fixes a critical vulnerability (CVE-2026-87902)
www.lemondeinformatique.fr · 14d ago · September 29th, 2026
The problem sits in the get_page_template() function, which WordPress uses to determine which PHP template renders a page. Data taken from the request can, after several processing and decoding steps, be used to build a file path that escapes the theme's intended template directory, and reaching this functionality requires no WordPress account, session, or authentication token. Exploitation is not automatic for every installation. He tested on WordPress 7.0.2 in isolated environments and notes his work says nothing about how many sites actually meet the required conditions. Beyond the identified attack path, the patch adds a check that resolved templates stay inside the permitted directories, chiefly in wp-includes/template.php. CERT-FR issued an advisory on September 23 classifying the risk as remote arbitrary code execution and recommends applying the WordPress fixes. Administrators should install 7.1.2 or the corresponding branch fix immediately; checking PHP settings and files reachable by the web server account can narrow some exploitation routes but does not replace patching. via Mastodon https://www.lemondeinformatique.fr/actualites/lire-wordpress-corrige-une-vulnerabilite-critique-100813.html