WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers

Site owners can close a critical WordPress vulnerability by updating to WordPress 7.1.2, released September 22. The flaw, tracked as CVE-2026-87902 with a CVSS score of 9.2, lets an attacker with no account make a site load a PHP file from outside its theme folders. On servers that already hold a specific kind of PHP file, that step can turn into running code of the attacker’s choosing.

What the WordPress 7.1.2 update fixes

The vulnerability sits in how WordPress selects the template file for a page. One of the file names WordPress builds comes from part of the web address. On affected versions, WordPress did not pass that value through its own check for ../ traversal steps, the same check the neighboring code already used.

Because the file name is built as page-{value}.php, a working attack needs two things. The active theme must have a top-level folder whose name starts with page-, and the target file must end in .php. Some themes, including older default WordPress themes, ship a folder that fits. The current default themes do not.

Loading a local PHP file runs whatever that file already does. Turning that into code of the attacker’s choosing requires a second condition: the server must already have a PHP file that does something useful when loaded. That is the “some servers” qualifier in WordPress’s description, and it is why the flaw does not mean full code execution on every affected site.

Which WordPress versions are affected

Every version from 4.7.0 through 7.1.1 is affected. That includes 7.1.1, which shipped in the September 17 security release. A site updated less than a week before this fix still needs the new one, because this is a separate flaw from the ones that earlier release addressed.

WordPress backported the fix to every older branch it still supports, down to 4.7.37. The release to update to depends on the branch a site runs:

• 7.1.x updates to 7.1.2
• 7.0.x updates to 7.0.6
• 6.9.x updates to 6.9.9
• 6.8.x updates to 6.8.10
• 6.7.x updates to 6.7.9
• 6.6.x updates to 6.6.9

Sites with automatic background updates enabled will start the update automatically. Others can update from the dashboard under Updates, or download the release from WordPress.org. WordPress does not offer a separate workaround, so updating is the fix.

How to tell how exposed a site is

Security vendor Patchstack, in its own analysis, lists two checks that show a site owner how close a site is to the worst case. Neither is a fix, but both indicate exposure.

• Whether the active theme has a top-level folder whose name begins with page-
• Whether PHP is running with a setting called register_argc_argv turned on, which a known code-execution technique depends on

That setting is off by default on PHP 8.5 and on by default on older PHP versions. The demonstrated attack ran code with the privileges of the web-server account, not full control of the server, and it was tested against WordPress 7.0.2 in isolated local labs, not the patched release or any live site.

Operators who cannot update immediately can reduce the route to code execution by turning register_argc_argv off for web requests and removing unused PEAR components. Neither action repairs the underlying flaw.

Disclosure and current status

The flaw was reported privately through WordPress’s HackerOne program in July. A detailed write-up, a proof-of-concept, and a self-contained test lab were published when the fix shipped. As of September 22, there were no reports of the flaw being used in attacks, and it had no entry in the U.S. CISA Known Exploited Vulnerabilities catalog.

FAQ

What is CVE-2026-87902 in WordPress?

CVE-2026-87902 is a critical vulnerability in WordPress core that lets an unauthenticated attacker make a site load a PHP file from outside its theme folders. On some servers, it can lead to code execution. WordPress rates it critical with a CVSS score of 9.2.

Which WordPress versions need the update?

Every version from 4.7.0 through 7.1.1 is affected. WordPress backported the fix to every branch it still supports, so site owners should update to 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9, or 6.6.9 depending on the branch they run.

Does this vulnerability affect every WordPress site?

Not equally. Loading a local PHP file runs whatever that file already does, but turning the flaw into code of an attacker’s choosing requires the server to already hold a PHP file that does something useful when loaded. Sites with themes that lack a top-level page- folder are less exposed.