CVE-2026-87902 is a critical (CVSS 9.2) vulnerability in WordPress core itself — not a plugin, not a theme, the actual template-resolution system every WordPress site runs. WordPress shipped the fix as version 7.1.2 on September 22, 2026, with backported patches reaching every supported branch back to 4.7. Attackers didn’t wait: Patchstack observed the first exploitation probing attempts within five hours of the patch going live, which tells you the window between disclosure and real-world attacks on unpatched sites has already closed for a meaningful share of installs.
Why a Core Vulnerability Is a Different Category of Problem
We cover plugin CVEs regularly because that’s where the overwhelming majority of WordPress vulnerabilities live — core itself is normally very well-tested and rarely the source of a critical flaw. That’s exactly what makes this one worth treating differently: it affects every WordPress site running an unpatched version, 4.7 through 7.1.1, regardless of which plugins or theme you use.
How the Vulnerability Actually Works
The flaw sits in /wp-includes/template.php, in WordPress’s own page-template resolution logic (the get_page_template() function). An unauthenticated attacker can abuse a double URL-encoded pagename query parameter that survives WordPress’s initial sanitization and is only decoded later — letting them include an arbitrary, readable local PHP file from outside the active theme directory. That’s a path traversal and local file inclusion primitive at its core, not automatic full remote code execution by itself.
What Actually Determines Whether a Specific Site Is Exploitable for RCE
The core vulnerability is local file inclusion; turning that into working remote code execution requires additional conditions to line up on a given site — specifically, a theme containing a top-level directory whose name begins with page-, and a local PHP file readable by the web server that does something useful when included. Not every vulnerable site meets both conditions, but the base file-inclusion primitive is real and unauthenticated on every unpatched install regardless.
Who’s Affected
| Version | Status |
|---|---|
| 4.7.0 through 7.1.1 | Vulnerable — actively probed, update immediately |
| 7.1.2 or later (or the backported patch for your branch) | Patched |
What to Do Right Now
- Update WordPress core to 7.1.2, or confirm your site auto-updated (core security releases are the one category almost universally recommended for auto-update, and this is exactly the kind of release that default protects against).
- If you’re on an older major branch, confirm the backported patch applied — WordPress issued fixes reaching back to 4.7, so “I’m on an old version” isn’t itself protection.
- Check your active theme for a top-level directory starting with
page-— if one exists, treat this as higher-priority even after patching, and review what’s in it. - Given active probing was observed within hours of disclosure, check logs for unusual
pagenameparameter requests around and after September 22, particularly anything with double-encoded characters.
If you find signs of a completed compromise, we cover the recovery process in WordPress Site Hacked? Here’s the Recovery Checklist We Actually Use. Want a site checked directly? Get in touch.
Frequently Asked Questions
Does this affect every WordPress site regardless of theme or plugins?
The underlying local file inclusion vulnerability is present on every unpatched core install (4.7–7.1.1) regardless of theme or plugins. Whether that escalates to full remote code execution on a specific site depends on theme directory structure and readable local files.
Is this worse than the recent plugin CVEs covered here?
In terms of scope, potentially yes — plugin CVEs only affect sites running that specific plugin; a core vulnerability affects every unpatched WordPress install regardless of configuration, which is why core vulnerabilities at this severity are comparatively rare and significant events.
If my site auto-updates core, am I already safe?
Very likely, but it’s worth explicitly confirming the update actually applied rather than assuming — check your WordPress version in wp-admin directly to verify you’re on 7.1.2 or later (or the correct backported version for your branch).
Featured image: original illustration.