WordPress Patches Critical Remote Code Execution Vulnerability
Unpatched servers could allow attackers to execute arbitrary PHP code without authentication
1Critical security flaw discovered
WordPress core contained a vulnerability (CVE-2026-87902) rated 9.2 CVSS that allows unauthenticated attackers to include arbitrary PHP files. The flaw exists in template file selection logic where ../ traversal checks were missing. All versions from 4.7.0 through 7.1.1 are affected, including recent security updates. WordPress released patches across all supported branches down to 4.7.37.
2Exploitation requirements
Successful exploitation requires two conditions: the active theme must have a top-level folder starting with 'page-', and the server must have PHP files that perform useful actions when loaded. Some default WordPress themes meet the first condition. The vulnerability doesn't automatically grant full code execution - it depends on server configuration and existing PHP files.
3Patch deployment details
WordPress released version 7.1.2 on September 22 containing the fix, with backported patches for all supported branches. Sites with automatic updates enabled will receive the patch automatically. Others must manually update via dashboard or WordPress.org. No workaround exists beyond updating. The flaw is separate from vulnerabilities fixed in the September 17 security release.
4Technical root cause
The vulnerability stems from insufficient sanitization when building template file names from URL parameters. While neighboring code had ../ traversal checks, this specific path construction lacked them. The constructed filename follows 'page-{value}.php' format, requiring specific theme structures for exploitation. Patchstack notes PHP's register_argc_argv setting affects exploitability.
5Current threat status
As of September 22, there were no reports of active exploitation, no public proof-of-concept code, and no listing in CISA's Known Exploited Vulnerabilities catalog. The vulnerability was responsibly disclosed by researcher Robert Ressl. WordPress security team responded with comprehensive patches across all supported versions.
6Risk assessment factors
Patchstack identifies two key indicators of exposure: presence of 'page-' prefixed theme folders and PHP's register_argc_argv setting. While neither mitigates the vulnerability, they signal higher risk. The setting defaults to on in PHP versions below 8.5. Sites running older PHP with vulnerable themes face the highest risk of full code execution.
7Update urgency
The critical rating reflects the vulnerability's potential impact - unauthenticated attackers could gain code execution on vulnerable configurations. Despite no active exploits, the public disclosure increases attack likelihood. WordPress strongly recommends immediate updates, especially for sites using older PHP versions or themes containing 'page-' folders.
8Broader security implications
This vulnerability highlights ongoing challenges in web application security, particularly in popular CMS platforms. The incident demonstrates the importance of comprehensive input validation and defense-in-depth measures. Organizations should review not just WordPress core but also theme security and server configurations to minimize attack surfaces.
Original article: The Hacker News — WordPress Patches Critical Remote Code Execution Vulnerability