WordPress 7.1.2 Fixes CVE-2026-87902: Affected Versions and Conditional RCE Requirements
WordPress 7.1.2, released September 22, 2026, fixes CVE-2026-87902, a critical unauthenticated path-traversal vulnerability in page-template resolution. The WordPress security advisory assigns the issue a CVSS 4.0 score of 9.2. An attacker can cause get_page_template() to include a chosen readable local PHP file outside the active theme directories; remote code execution becomes possible when additional theme and server prerequisites are present.
The vulnerability affects WordPress 4.7.0 through 7.1.1 across the corresponding maintained branches. WordPress has published patched releases back to the 4.7 branch. Sites on the current 7.1 line should update to 7.1.2 immediately; sites remaining on older branches should install the matching security backport.
This is a separate vulnerability from the issues fixed in WordPress 7.1.1 on September 17. A site that installed 7.1.1 still requires the 7.1.2 security update.
Patched WordPress versions
The official GitHub security advisory lists these fixed versions:
| Branch | Affected through | Patched version |
|---|---|---|
| 7.1 | 7.1.1 | 7.1.2 |
| 7.0 | 7.0.5 | 7.0.6 |
| 6.9 | 6.9.8 | 6.9.9 |
| 6.8 | 6.8.9 | 6.8.10 |
| 6.7 | 6.7.8 | 6.7.9 |
| 6.6 | 6.6.8 | 6.6.9 |
| 6.5 | 6.5.11 | 6.5.12 |
| 6.4 | 6.4.11 | 6.4.12 |
| 6.3 | 6.3.11 | 6.3.12 |
| 6.2 | 6.2.12 | 6.2.13 |
| 6.1 | 6.1.13 | 6.1.14 |
| 6.0 | 6.0.15 | 6.0.16 |
| 5.9 | 5.9.17 | 5.9.18 |
| 5.8 | 5.8.16 | 5.8.17 |
| 5.7 | 5.7.18 | 5.7.19 |
| 5.6 | 5.6.20 | 5.6.21 |
| 5.5 | 5.5.21 | 5.5.22 |
| 5.4 | 5.4.22 | 5.4.23 |
| 5.3 | 5.3.24 | 5.3.25 |
| 5.2 | 5.2.27 | 5.2.28 |
| 5.1 | 5.1.25 | 5.1.26 |
| 5.0 | 5.0.28 | 5.0.29 |
| 4.9 | 4.9.32 | 4.9.33 |
| 4.8 | 4.8.31 | 4.8.32 |
| 4.7 | 4.7.36 | 4.7.37 |
WordPress.org says only the latest release is actively supported; the older-branch fixes are security backports provided as a courtesy. Updating to the latest supported WordPress release remains the preferred maintenance path where application compatibility permits it.
When CVE-2026-87902 can become RCE
The underlying flaw allows unauthenticated traversal during page-template resolution. The official advisory identifies two important environmental prerequisites for the code-execution path.
First, the active parent or child theme must contain a top-level directory whose name begins with page-, such as page-templates. WordPress names legacy Twenty Twelve and Twenty Fourteen, along with third-party themes including Neve, Hestia and Sydney, as examples with relevant directory layouts.
Second, a suitable readable local PHP file must exist on the server. The advisory identifies configurations involving PEAR and register_argc_argv as one route that can satisfy this requirement. It specifically notes exposure in the official PHP Docker image and in default cPanel configurations using PHP versions before 8.5 under the documented conditions.
These prerequisites affect whether the file-inclusion flaw reaches arbitrary code execution; they do not remove the need to patch an affected WordPress installation.
What operators should check
The primary action is to install the fixed WordPress release for the site's branch. WordPress.org recommends immediate updating and says sites configured for automatic background updates will begin receiving the security release automatically.
For exposure assessment and incident triage, operators can also inventory the active parent and child themes for top-level directories beginning with page-, confirm the PHP runtime and hosting configuration, and review web and application logs for anomalous requests around page-template handling. Sites using container images or shared-hosting stacks should verify the deployed WordPress version from the running environment rather than relying only on an image tag or control-panel display.
Theme inspection is an exposure-assessment step, not a substitute for the core update. The vulnerable page-template resolution exists in WordPress core across the affected versions.
Exploitation status and severity
The WordPress advisory rates CVE-2026-87902 Critical with a CVSS 4.0 base score of 9.2. Its vector records network reachability, low attack complexity, no required privileges and no user interaction, while also recording that attack requirements are present.
As of the September 22 disclosure, reputable independent reporting had found no public report of active exploitation and no CISA Known Exploited Vulnerabilities entry for CVE-2026-87902. The remediation decision is driven by the critical core flaw and broad affected-version range rather than a confirmed exploitation campaign.
Bottom line
WordPress operators should move 7.1.x installations to 7.1.2 and apply the corresponding fixed release on any older branch that cannot yet be upgraded. CVE-2026-87902 is remotely reachable without authentication, while the RCE outcome depends on identifiable theme and server conditions. That makes the immediate operational sequence straightforward: patch WordPress first, then use theme and PHP configuration checks to prioritize deeper investigation of installations that met the documented RCE prerequisites before the update.
Sources
- WordPress.org — WordPress 7.1.2 release: https://wordpress.org/news/2026/09/wordpress-7-1-2-release/
- WordPress security advisory — GHSA-7hp8-65ch-5whp / CVE-2026-87902: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
- WordPress.org — Version 7.1.2 documentation: https://wordpress.org/documentation/wordpress-version/version-7-1-2/
- The Hacker News — independent remediation and exposure analysis: https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html