WordPress site owners should update immediately: attackers are actively exploiting CVE-2026-87902, an unauthenticated path-traversal flaw in WordPress core that can become remote code execution when specific theme and server conditions are present. WordPress 7.1.2 contains the current fix, while patched releases are also available for older branches back to WordPress 4.7.
Key takeaways
- CVE-2026-87902 affects WordPress core, not a third-party plugin.
- No login is required to attempt exploitation, but successful code execution depends on the active theme and server environment.
- WordPress published patched versions on 22 September 2026; exploitation attempts were observed the same day.
- Updating core is the reliable fix. A firewall can reduce exposure, but it should not replace the update.
- After patching, administrators should still review access logs, files and privileged users for signs of earlier compromise.
What happened with CVE-2026-87902?
WordPress released version 7.1.2 on 22 September as a security update for one core vulnerability. The official advisory describes an unauthenticated path traversal in page-template resolution. In plain language, a specially constructed request can make WordPress look outside the intended theme directory and include a readable local PHP file.
That file inclusion does not automatically mean every unpatched site can be taken over. Remote code execution requires additional conditions, including a compatible theme-directory layout and a useful local PHP file that the web-server account can read. However, those conditions exist on real hosting configurations, so the flaw is not theoretical.
The urgency increased after disclosure. Patchstack reported active exploitation attempts, including activity intended to write attacker-controlled PHP content. The Cyber Security Agency of Singapore subsequently advised affected administrators to patch immediately.
| Question | Answer |
|---|---|
| Vulnerability | CVE-2026-87902 |
| Component | WordPress core page-template resolution |
| Authentication needed | No |
| Primary impact | Path traversal and local file inclusion; conditional remote code execution |
| Official severity | Critical, CVSS 9.2 in the WordPress GitHub advisory |
| Exploitation status | Active exploitation reported after disclosure |
| Recommended action | Install the patched release for your branch immediately |
Which WordPress sites are affected?
The WordPress security advisory lists vulnerable branches from WordPress 4.7 through 7.1.1. That broad version range means administrators should not assume an older long-running site is safe simply because it does not use WordPress 7.1.
Exploitation still depends on environmental preconditions. The active parent or child theme must contain a top-level directory beginning with page-, such as page-templates. A readable local PHP target must also be available. The advisory identifies legacy Twenty Twelve and Twenty Fourteen among affected theme layouts, along with some third-party themes, but that is not a complete safe-or-vulnerable list.
Do not use the absence of a named theme as a reason to delay. The code flaw is in WordPress core, themes can change, and a server may contain files that make the impact worse. Updating is faster and more dependable than trying to prove that every prerequisite is absent.
Is WordPress 7.1.2 itself affected?
No. WordPress 7.1.2 contains the fix. If automatic core updates are enabled, the site may already be patched, but administrators should verify the installed version rather than assume the update completed.
Which WordPress versions contain the fix?
The best choice for most sites is the latest stable WordPress release, currently 7.1.2. WordPress also backported the correction to older branches. The table below covers the branches most likely to remain in production; the official advisory lists additional patched releases back to 4.7.37.
| Installed branch | First patched release | Recommended action |
|---|---|---|
| 7.1 | 7.1.2 | Update to 7.1.2 or newer |
| 7.0 | 7.0.6 | Update to 7.0.6 or preferably current stable |
| 6.9 | 6.9.9 | Update to 6.9.9 or preferably current stable |
| 6.8 | 6.8.10 | Update to 6.8.10 or preferably current stable |
| 6.7 | 6.7.9 | Update to 6.7.9 or preferably current stable |
| 6.6 | 6.6.9 | Update to 6.6.9 or preferably current stable |
| 6.5 | 6.5.12 | Update to 6.5.12 or preferably current stable |
| 6.4 | 6.4.12 | Update to 6.4.12 or preferably current stable |
| 6.3 | 6.3.12 | Update to 6.3.12 or preferably current stable |
| 6.2 and older | Branch-specific backports | Use the exact patched version in the official advisory, then plan a supported-version upgrade |
WordPress notes that only the latest release is actively supported. The backports are valuable for emergency risk reduction, but they should not become a reason to leave an outdated installation unchanged indefinitely. Our earlier WordPress 7.1 guide explains the broader release changes for administrators planning a controlled upgrade.
How to update WordPress safely right now
Take a current database and file backup before changing production, but do not turn that precaution into a long delay. The update can be installed from Dashboard → Updates, or through WP-CLI when command-line access is available.
wp core version
wp core update
wp core versionThe first command records the starting version. The update command installs the newest WordPress core release available to the site, and the final command confirms the result. On managed hosting, use the provider’s tested update workflow if it wraps or replaces the standard updater.
After the update, load the homepage, sign in to the dashboard, test a representative post and page, and clear page, object and CDN caches. If a staging environment is available, a quick compatibility check is sensible, but an internet-facing production site should not remain unpatched for days while waiting for a perfect test window.
What if the dashboard update is unavailable?
Check filesystem permissions, available disk space, maintenance mode and whether the hosting provider manages core updates centrally. WordPress also publishes official packages and version-specific update information. Avoid downloading replacement files from mirrors or unofficial archives.
Can a web application firewall replace the patch?
No. A WAF rule can provide useful temporary protection, particularly during a large fleet rollout, but rules can be bypassed or misconfigured. The corrected core version removes the vulnerable behavior and remains the primary fix.
What should you check after updating?
Patching prevents future use of the vulnerable code path, but it does not undo an earlier intrusion. Because exploitation activity began soon after the public release, administrators of exposed sites should perform a focused review.
- Review web access logs for unusual requests combining page identifiers with encoded path traversal patterns.
- Look for unexpected PHP files or recently changed files in writable directories, temporary directories and the web root.
- Compare WordPress core files against known-good checksums with
wp core verify-checksums. - Review administrator accounts, application passwords, scheduled tasks and active plugins for changes you did not authorize.
- Inspect security-plugin and hosting-provider alerts around 22 September onward.
- If compromise is suspected, preserve logs and a forensic copy before deleting evidence or rebuilding.
A clean checksum result is helpful but not a complete incident-response conclusion. An attacker could place files outside WordPress core, create a privileged account or alter the database. Sites showing credible indicators should rotate WordPress salts, hosting credentials, database passwords and relevant API keys after containment.
For broader maintenance context, see our coverage of the Mailgun WordPress plugin vulnerability. That issue affected a plugin, while CVE-2026-87902 affects core, but both demonstrate why backups, rapid patching and post-update review belong in the same security process.
What should hosting providers and agencies do?
Teams managing many sites should first inventory the installed WordPress version and public exposure, then deploy the appropriate patched branch. The official fix was backported widely, so even customers who cannot complete a major-version upgrade today can receive the security correction.
Prioritize internet-facing sites using theme layouts that match the advisory’s prerequisite, servers where PHP configuration increases the risk of code execution, and installations with delayed or disabled automatic updates. Then review fleet-wide telemetry for the same encoded traversal patterns rather than waiting for individual customers to report visible damage.
Agencies should also communicate clearly with clients: “updated” and “checked for compromise” are separate outcomes. A maintenance report should record the old version, patched version, update time, cache purge, basic functional test and security review performed.
Our assessment
This is a high-priority WordPress core update, but it should be described accurately. CVE-2026-87902 does not give every attacker instant code execution on every unpatched site. Specific theme and server conditions are required. At the same time, those conditions are common enough, the attack needs no account, and active exploitation has already been reported.
The practical decision is therefore simple: update now, then check whether the site was targeted before the patch landed. Administrators should not spend the first response window debating whether their current theme appears on an example list.
Frequently asked questions
What is CVE-2026-87902?
It is an unauthenticated path-traversal vulnerability in WordPress core page-template resolution. Under specific theme and server conditions, it can allow local PHP file inclusion and remote code execution.
Has CVE-2026-87902 been exploited?
Yes. Patchstack reported probing on the day the patch was released and later observed attempts to write attacker-controlled PHP files. Government and security organizations now advise immediate patching.
Which WordPress version should I install?
Install WordPress 7.1.2 or a newer stable release when available. If a site must remain on an older branch temporarily, install the branch-specific patched version listed in the official advisory.
Does updating prove my site is clean?
No. Updating closes the vulnerability, but a site attacked before the update may still contain unauthorized files, accounts or configuration changes. Review logs and integrity after patching.
Is disabling the active theme enough?
No. Theme layout is only one exploitation prerequisite, and changing a theme is not a substitute for correcting the vulnerable WordPress core code.
Comments