AI-generated editorial illustration; not a documentary photograph.
WordPress released version 7.1.2 on September 22 to fix CVE-2026-87902, a critical core vulnerability that allows an unauthenticated attacker to make affected sites load PHP files from outside their theme directories. Under additional server conditions, the flaw can enable attacker-controlled code execution. Patched releases are also available for every supported branch back to WordPress 4.7.
Which Sites Are Affected
The vulnerability affects WordPress 4.7.0 through 7.1.1 and carries a CVSS score of 9.2. Sites that installed the September 17 security release still require another update because WordPress 7.1.1 remains vulnerable and the new issue is separate from the flaws addressed in that release.
Automatic background updates will begin installing the relevant patched release where enabled. Other administrators must update through the WordPress dashboard or obtain the release from WordPress.org. WordPress has not provided a separate workaround, making installation of the patch the required remediation.
How the Flaw Works
The weakness concerns the selection of page template files. A value derived from the web address was incorporated into a filename without passing through WordPress's existing check for directory traversal sequences, even though nearby code used that validation.
Exploitation also depends on the active theme containing a top-level directory whose name begins with page-, while the targeted file must have a .php extension. Some older default WordPress themes meet the directory condition, but current default themes do not.
Code Execution Has Extra Conditions
Loading a local PHP file executes its existing behavior, but arbitrary code execution is not automatic on every vulnerable installation. The server must already contain a suitable PHP file. Patchstack said exposure to a known execution technique also depends on PHP's register_argc_argv setting, which is disabled by default in PHP 8.5 but enabled by default in older versions.
Researcher Robert Ressl demonstrated execution with the privileges of the web-server account in isolated local labs running WordPress 7.0.2. The demonstration did not test the patched release or a live website. Ressl suggested disabling register_argc_argv for web requests and removing unused PEAR components when an immediate update is impossible, but neither measure fixes the underlying vulnerability.
No Reported Exploitation
As of September 22, no attacks exploiting the vulnerability had been reported, and CVE-2026-87902 was not listed in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog. Ressl disclosed the issue privately through WordPress's HackerOne program in July and published technical details and a proof of concept when the fix became available.
Source: WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
SIGNAL TITANS
Leave a Reply