Do Son 
TL;DR
WordPress recently released version 7.1.2 to address a critical path traversal flaw. This WordPress RCE vulnerability allows an unauthenticated attacker to execute arbitrary code under specific server conditions. Site administrators should apply this security update immediately to protect their digital assets.
- CVE: CVE-2026-87902
- CVSS: 8.1 (High · CVSSv3)
- Product: WordPress
- Affected: < 7.1.2
- Impact: CWE-98
- Status: No confirmed exploitation yet
- Patched in: 7.1.2
- Action: Update to 7.1.2 now
Track every WordPress CVE the moment it's exploited.
Get free email alertsWhy It Matters
WordPress powers over 43% of the internet. This scale makes any core security flaw a massive risk to the global web ecosystem. Therefore, this specific WordPress RCE vulnerability allows unauthorized users to read arbitrary files. Additionally, they can also potentially run malicious scripts. Consequently, it threatens the integrity of millions of active sites. Fortunately, the vendor confirms that researchers responsibly disclosed this defect. No active exploitation in the wild or public proof-of-concept has been confirmed yet.
How The Attack Works
The issue originates in the get_page_template() page-template resolution function. Specifically, an unauthenticated attacker can manipulate this function. This manipulation includes a readable local.php file from outside the active theme directories. If the active theme contains a top-level directory starting with page-, the attacker triggers an unauthenticated path traversal. Ultimately, by targeting specific files, the attacker achieves remote code execution. For instance, one common target is the well-known pearcmd.php transition when register_argc_argv is active.
Affected Versions
This flaw affects multiple legacy and popular themes. Specifically, impacted themes include Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney. Furthermore, some default server setups face higher risks. Servers utilizing the official PHP Docker image are highly susceptible. Default cPanel configurations running PHP versions prior to 8.5 also remain exposed. Overall, the core vulnerability exists in WordPress versions up to 7.1.1.
Patch Or Mitigation Steps
Site owners must upgrade to WordPress 7.1.2 immediately. As a courtesy, the core team also backported the patch to all older branches. This covers releases dating back to version 4.7. First, you can apply the fix directly through your dashboard. Alternatively, you can download the update by reading the WordPress 7.1.2 release announcement. Finally, check your theme and server configurations to further reduce your exposure.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
