WordPress releases fixes for CVE-2026-87902 across supported branches

WordPress has released security updates for CVE-2026-87902, a critical core vulnerability with a CVSS score of 9.2 that can allow an unauthenticated attacker to make an affected site load a PHP file outside its theme folders. WordPress 7.1.2 shipped on September 22, alongside fixes for every branch still supported by the project, including releases back to 4.7.

The issue affects WordPress versions 4.7.0 through 7.1.1. It requires neither an account nor an action by a logged-in user. Sites that installed WordPress 7.1.1 after the September 17 security release are still affected and need this separate update.

Matching the update to the installed branch

Administrators on the 7.1 branch should move to 7.1.2. The corresponding releases are 7.0.6 for 7.0.x, 6.9.9 for 6.9.x, 6.8.10 for 6.8.x, 6.7.9 for 6.7.x, and 6.6.9 for 6.6.x. WordPress also backported the correction to older supported branches, down to version 4.7.37.

Sites with automatic background updates enabled will begin receiving the update automatically. Other operators can use the Updates screen in the WordPress dashboard or obtain the relevant release from WordPress.org. WordPress has not provided a separate workaround, making installation of the appropriate patched release the prescribed remediation.

Why code execution is conditional

The vulnerability lies in template-file selection. WordPress constructs one filename from a portion of the web address, but affected versions did not pass that value through the project’s check for ../ traversal sequences, even though neighbouring code used that check. This can be used to direct WordPress to load a local PHP file.

Loading a local PHP file executes what that file already does; it does not by itself guarantee attacker-controlled code execution. A successful path must also meet specific conditions: the active theme needs a top-level directory whose name starts with page-, and the target must be a PHP file. Some older default WordPress themes include a directory matching that pattern.

Patchstack identified two exposure checks for site owners: whether the active theme has such a top-level page- directory and whether PHP has register_argc_argv enabled. The latter setting is needed by a known code-execution technique. It is off by default in PHP 8.5 and on by default in earlier PHP versions, but neither check replaces patching. The operational context is reinforced by large-scale WordPress and Joomla attack activity and its account of large-scale WordPress and Joomla attack activity.

Immediate actions for site operators

As of September 22, there were no reports of exploitation, no public proof-of-concept, and no listing for CVE-2026-87902 in CISA’s Known Exploited Vulnerabilities catalog. WordPress credited Robert Ressl with reporting the flaw.

Businesses should identify the WordPress branch operating on every site, install the matching security release, and verify that automatic updates completed. Reviewing the active theme’s directory layout and the PHP register_argc_argv setting can help prioritise follow-up checks, while the update remains the practical business requirement for removing the disclosed core flaw.