Critical WordPress Flaw Lets Unauthenticated Attackers Execute Remote Code

WordPress has released version 7.1.2 to address a critical path-traversal vulnerability, tracked as CVE-2026-87902, which could allow unauthenticated remote code execution (RCE) under specific server and theme configurations.

This flaw carries a CVSS v4 score of 9.2 and affects WordPress versions dating back to 4.7.

Critical WordPress Flaw

The issue arises from improper page-template resolution in WordPress’s `get_page_template()` functionality. An unauthenticated remote attacker could exploit this by manipulating template resolution, enabling WordPress to include a locally readable PHP file chosen by the attacker, located outside the active theme directories.

This creates a path traversal condition that, under the right circumstances, can escalate to arbitrary PHP code execution on the affected web server.

The vulnerability is classified under CWE-98, which pertains to improper control of filenames used in PHP include or require operations.

The advisory rates this vulnerability as critical because exploitation requires no authentication or user interaction and can compromise the confidentiality, integrity, and availability of the affected WordPress installation.

While exploitation is possible, it is conditional, not universal. According to the advisory, attackers need two key preconditions:

• The active parent or child theme must contain a top-level directory starting with “page-“, such as “page-templates.”
• A readable local .php file must exist on the server and be accessible to the web server process.

Affected themes include the legacy Twenty Twelve and Twenty Fourteen WordPress themes, as well as several third-party themes like Neve, Hestia, and Sydney.

A potentially dangerous chain involves PHP’s `pearcmd.php`, which can be exploited for PEAR-to-RCE behavior when the `register_argc_argv` PHP setting is enabled. The advisory notes that the official PHP Docker image is affected by this issue, as are default cPanel configurations using PHP versions earlier than 8.5.

The issue impacts WordPress versions 7.1.0 through 7.1.1, as well as older supported and security-maintained branches down to version 4.7.

WordPress 7.1.2 is the primary fixed release, with patched maintenance versions issued for each eligible branch, including 7.0.6, 6.9.9, 6.8.10, and 4.7.37.

WordPress has backported the patch for users operating older branches, although only the most recent version remains actively supported.

Administrators should update to WordPress 7.1.2 or the latest patched release available for their branch immediately.

Updates can be installed from the WordPress Dashboard by navigating to Updates → Update Now, and sites with automatic background updates enabled should begin updating automatically. The latest WordPress package is also available from the official download page.

Site owners should review their active and child themes for “page-*” directories, verify whether readable PHP files such as `pearcmd.php` are exposed to the web server account, and turn off unnecessary PHP configurations, including `register_argc_argv`, where operationally feasible. Security researcher Robert Ressl responsibly disclosed this vulnerability.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC