WordPress site owners have another security update to prioritize this week. WordPress 7.1.2, released on September 22, 2026, fixes CVE-2026-87902, a serious vulnerability in WordPress Core that can allow an unauthenticated attacker to make WordPress include a readable local PHP file outside the active theme directories. Under specific theme and server conditions, that can lead to remote code execution.
The issue is especially important today because security researchers have reported active probing and exploitation attempts. This is a different issue from the Click2Shell vulnerability already covered on WPFairs, so site owners should not assume that installing the earlier 7.1.1 update was sufficient.
What Is CVE-2026-87902?
CVE-2026-87902 is a WordPress Core vulnerability in page-template resolution. The vulnerable code can be influenced so that a page request causes WordPress to resolve a PHP file outside the directory where the active theme is expected to keep its templates. The flaw does not require a WordPress account or user interaction, although successful code execution depends on additional conditions on the site and server.
Why Site Owners Should Treat It Seriously
WordPress rated the vulnerability at a critical CVSS 9.2 under CVSS 4.0. The most important practical point is that an attacker does not need to log in. Researchers have also observed exploitation activity after the disclosure, including attempts to use local PHP files to write additional PHP files on vulnerable systems.
- Unauthenticated: the vulnerable request does not require a WordPress account.
- Theme-dependent: exploitation to code execution requires particular template-directory conditions.
- Server-dependent: additional PHP and filesystem conditions affect whether the issue can be turned into code execution.
- Actively probed: security researchers have reported scanning and exploitation attempts in the wild.
Which WordPress Versions Are Affected?
The vulnerable range includes WordPress versions before 7.1.2, with the security fix backported to supported branches. WordPress lists 7.1.2 as the current fix and says backports are being provided for eligible older branches down to 4.7.
For the 7.1 branch, the immediate action is to update to WordPress 7.1.2. If you maintain an older branch, install the latest security release available for that branch rather than leaving the site on an older vulnerable version.
How to Check Whether Your Site Is Patched
- Open Dashboard → Updates and check the installed WordPress version.
- If the site is running 7.1.1 or an earlier vulnerable release, update Core immediately.
- After updating, reload the Updates screen and confirm the new version is actually installed.
- Check your theme and hosting environment as part of a broader security review, especially if you use custom template directories or unusual PHP configuration.
- Review recent access and application logs for unexpected requests or newly created PHP files if the site was exposed while unpatched.
Is a Firewall Enough?
A web application firewall can provide an additional layer of protection, but it should not be treated as a replacement for the WordPress security update. Security vendors have described protections for the vulnerability, while also emphasizing that patching the affected Core code is the primary remediation.
What to Do If You Cannot Update Immediately
If an update is temporarily blocked by a compatibility or deployment problem, reduce exposure while you work toward patching. Keep a firewall or managed security layer active, restrict unnecessary access where possible, take a verified backup, and inspect the server for unexpected PHP files or suspicious changes. These are temporary risk-reduction measures, not substitutes for updating WordPress Core.
Bottom Line
CVE-2026-87902 is a separate and more recent WordPress Core security issue that deserves immediate attention. WordPress 7.1.2 contains the fix, and active exploitation has already been reported. Check every WordPress installation you manage, install the fixed release for its branch, and verify that the update completed successfully.
Leave a Reply to This Post