WordPress Core

WordPress Core contains a critical unauthenticated path traversal and local PHP file inclusion vulnerability tracked as CVE-2026-87902. The issue affects multiple WordPress branches, including WordPress 7.1.0 through 7.1.1. Update immediately to WordPress 7.1.2 or the September 22 security backport for your installed branch.

The official advisory assigns a CVSS v4.0 score of 9.2 (Critical); the Wordfence Intelligence record lists CVSS 8.1 under CVSS v3.1. Successful remote code execution is conditional, but no account or user interaction is required to reach the vulnerable template-resolution path.

Affected versions and fixed releases

• 7.1.0–7.1.1: update to 7.1.2
• 7.0.0–7.0.5: update to 7.0.6
• 6.9.0–6.9.8: update to 6.9.9
• 6.8.0–6.8.9: update to 6.8.10
• 6.7.0–6.7.8: update to 6.7.9
• Older maintained/backported branches: install the security release issued September 22 for that branch, down to 4.7.37.

WordPress.org provides courtesy security backports for older branches, but only the current branch receives normal maintenance. Apply the backport now if necessary, then plan an upgrade to a supported current release.

How the vulnerability works

Wordfence’s technical analysis explains that get_page_template() uses the URL-derived pagename value to construct a page-template candidate. An additional URL-decoding step can expose traversal syntax, and affected versions of locate_template() did not confirm that the resolved file stayed inside an approved theme directory before loading it.

That gives an unauthenticated attacker a local PHP file inclusion primitive. Remote code execution requires additional conditions: the active parent or child theme must contain a suitable top-level page-* directory, and the server must contain a useful readable PHP file. The advisory cites Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney as examples of themes with relevant directory layouts, but exposure must be verified from the actual filesystem rather than inferred from a theme name alone.

Patch and verify

1. Back up the site and database.
2. Install WordPress 7.1.2 or the fixed release for your branch.
3. Confirm the installed version after the update and test login, page rendering, forms, and checkout.
4. Purge page, object, CDN, and opcode caches where applicable.
5. Do not treat a WAF rule as a permanent substitute for updating Core.

wp core version
wp core check-update

After updating, confirm the installed Core files match the official checksums:

wp core verify-checksums

Detection and incident response

Review web-server and WAF logs for suspicious traversal-like values associated with the pagename parameter, including encoded variants. Do not test a live site with exploit payloads. If logs show a request reaching the vulnerable template path, preserve the logs and treat the site as potentially compromised. Review administrator accounts, recently changed plugins and themes, scheduled tasks, must-use plugins, and unexpected PHP files. Restore trusted code, rotate credentials, and perform a full incident investigation where execution cannot be ruled out.

Sources

• Wordfence technical analysis
• Wordfence Intelligence record
• WordPress Core security advisory
• WordPress release archive