WordPress 7.1.2 Patches CVE-2026-87902 File Inclusion Flaw

WordPress has released version 7.1.2 to fix a critical vulnerability in its core software. The flaw lets unauthenticated attackers load local PHP files and, on some server configurations, run arbitrary code.

Tracked as CVE-2026-87902, the flaw has a CVSS score of 9.2 (4.0). It affects every WordPress release from 4.7.0 through 7.1.1. Security researcher Robert Ressl found it and reported it privately through the WordPress HackerOne program in July.

“Because this is a security release, it is recommended that you update your sites immediately,” WordPress said in its release announcement. The fix has also been backported to older branches.

Page templates open a path outside the theme

The flaw lies in how WordPress selects a template when rendering a page.

An attacker sends an anonymous request with two public values, pagename and page_id. The page_id points to a real published page, so WordPress serves it normally. The pagename value, which carries a double-encoded directory traversal, stays in the query.

WordPress’s get_page_template() function later decodes that value and uses it to build a template filename. The decode turns the hidden traversal characters into a working file path. That path can point outside the theme’s folders, and WordPress includes whatever PHP file it lands on.

Patchstack notes that WordPress already checked a neighboring template value for traversal, but skipped this one. The 7.1.2 update adds that check. It also adds a new rule that every resolved template path must stay inside an allowed theme directory.

Not every site is exposed

The attack depends on specific conditions. The active theme must have a top-level folder whose name starts with “page-“, such as page-templates/, a layout that WordPress’s own documentation recommends.

Ressl found that the Twenty Twenty-Three, Twenty Twenty-Four, and Twenty Twenty-Five default themes lack such a folder. Patchstack says older default themes and a number of popular third-party themes include one.

Getting from file inclusion to code execution needs more. In Ressl’s lab tests, the attack relied on PEAR files already present in the official WordPress Docker image, the register_argc_argv PHP settings, and a writable directory. Patchstack says that the setting is enabled by default in official PHP Docker images and in cPanel environments running PHP below 8.5.

Code executed this way runs with the web server account’s permissions. That is enough to read database credentials and modify site content.

“The important distinction is between canonicalization and containment,” Ressl explained. Normalizing a file path does not prove that the file is within a folder that the application trusts.

Ressl has published a proof of concept and a test lab on GitHub. No attacks exploiting the flaw have been reported so far.

Update WordPress now

Administrators should install WordPress 7.1.2 or the patched release for their branch: 7.0.6, 6.9.9, 6.8.10, or earlier, back to 4.7.37. Sites with automatic background updates enabled should receive the fix automatically.

Sites that cannot update immediately can reduce risk by turning off register_argc_argv for web requests, removing unused PEAR files, and limiting where PHP can write. Ressl stresses these steps are not a substitute for the patch.

The fix follows a busy few months for WordPress core security.

A Busy Run of WordPress Core Flaws

CVE-2026-87902 is the latest in a series of recent WordPress core bugs:

• wp2shell (July): In July, researchers disclosed a no-login code-execution chain in WordPress Core comprising CVE-2026-63030 and CVE-2026-60137. CISA added it to its Known Exploited Vulnerabilities catalog.
• XSS2Shell (August): XSS2Shell (CVE-2026-64638) turned a failed login into attacker-controlled JavaScript and was fixed in 7.0.3.
• Click2Shell (last week): WordPress 7.1.1 patched a Click2Shell vulnerability that could trick a logged-in administrator’s browser into installing and previewing a theme.