WordPress 7.1.2 is a security-only update for a critical unauthenticated path-traversal flaw that can expose local files and, on some servers, allow remote code execution. The advisory record shows broad version exposure with conditional code execution, plus confirmed in-the-wild exploitation days after release.
Path traversal means an attacker changes a file path to reach files outside the intended folder. Here the issue is in page-template resolution in get_page_template(), scored 9.2 Critical under CVSS 4.0. According to Wordfence, WordPress released version 7.1.2 on September 22, 2026 to fix CVE-2026-87902, reported by Robert Ressl Wordfence advisory on the WordPress flaw.
Table of Contents
- What failed in WordPress core?
- Which sites are exposed?
- When does file access become code execution?
- What does the attack evidence show?
- What should site operators do now?
What failed in WordPress core?
The flaw allows an unauthenticated visitor to influence template-file selection. A crafted request can traverse directories and cause local file inclusion, where WordPress includes a local file as part of a page response.
That inclusion can reveal file contents or behavior useful for further attack. Wordfence classifies the weakness as CWE-98 with Critical severity.
Which sites are exposed?
All WordPress core versions from 4.7.0 through 7.1.1 are affected. According to BleepingComputer, fixes were backported to every branch back to 4.7, while releases before 4.6 receive no fix BleepingComputer report on affected versions.
Exploitation also needs a theme layout condition. The active parent or child theme must contain a top-level page-* directory. Cited examples include Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney.
When does file access become code execution?
File inclusion alone does not automatically give command execution. Remote code execution additionally needs a readable local PHP file that performs a useful action when included.
One discussed example is pearcmd.php with register_argc_argv enabled, noted in the official PHP Docker image and default cPanel on PHP below 8.5. The practical limit is direct: code execution occurs only when both the vulnerable theme layout and a suitable server-side file are present.
What does the attack evidence show?
Patchstack observed the first malicious requests on Sept. 22 at 17:44 UTC from a small set of IP addresses. Early requests included ordinary core files, consistent with reconnaissance. By Sept.
23, attack volume rose more than tenfold and payloads shifted from probing to writing PHP files. Later reports described webshell-style files placed for command execution. According to CISA, the agency added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog on Sept. 25, 2026 based on evidence of active exploitation CISA notice adding the flaw to the KEV catalog.
What should site operators do now?
WordPress recommends updating sites immediately to 7.1.2 or the backported branch release. Check the active parent and child themes for a top-level page-* directory, inventory internet-facing WordPress hosts, and prioritize public sites first.
- Update to 7.1.2 or the fixed release for the current branch.
- Verify the update completed on every copy, including staging and forgotten microsites.
- Review newly created PHP files, unexpected admin accounts, scheduled tasks, and outbound connections.
- Restore from a clean backup and rotate credentials if a webshell or unknown file is found.
You Might Also Like
- Not a Hack, Still an Exposure: What the ChatGPT Human-Review Lawsuit Says Contractors Could See
- How to Verify Ransomware Attacks Claims in 2026: breach notices and security advisories, Evidence, and Red Flags
- UK Data Breach Recovery: What to Do if Someone Opens an Account in Your Name