WordPress Patches Critical Core Vulnerability as Attackers Exploit Flaw Within Hours

On September 22, 2026, WordPress released version 7.1.2 to close a critical path traversal vulnerability in its core software. Within hours of the patch becoming public, threat actors began actively scanning and exploiting unpatched sites to achieve remote code execution. The flaw, tracked as CVE-2026-87902, carries a severity score of 9.2 out of 10 and affects every WordPress release from version 4.7.0 through 7.1.1—a span covering nearly 10 years of the platform's history. The rapid weaponization of the vulnerability has forced administrators into an emergency patching cycle to secure their infrastructure against automated compromise.[1][2][5]

While early security alerts often frame any remote code execution flaw as a universal compromise, CVE-2026-87902 is not an unconditional skeleton key for every WordPress installation. The vulnerability itself is a local file inclusion primitive located within the platform's page-template resolution logic. An unauthenticated attacker can manipulate the value WordPress uses when selecting a template, forcing the system's core routing to include a readable PHP file from outside the active theme's directories. This bypasses standard access controls, but the immediate result is limited to file inclusion rather than arbitrary command execution.[1][4]

Turning that initial file inclusion into actual code execution requires the target server to meet two specific structural conditions. First, the active parent or child theme must contain a top-level directory whose name begins with the string "page-", such as "page-templates". This directory structure is present in several popular themes, including legacy default themes like Twenty Twelve and Twenty Fourteen, as well as widely deployed third-party options like Neve, Hestia, and Sydney. If the active theme lacks this specific prefix, the traversal sequence fails to resolve correctly.[1][4][5]

Second, the server must already host a suitable "gadget" PHP file that produces useful behavior when included by the attacker. Security researchers demonstrated the attack using the PEAR package manager's "pearcmd.php" file in environments where PHP's "register_argc_argv" setting is enabled. This specific configuration is notably present in some official PHP Docker images and older default cPanel setups, providing the necessary bridge from local file inclusion to full system compromise. Without a reachable gadget file, the attacker cannot execute their own payloads.[1][3]

Despite these environmental prerequisites, the speed of weaponization has been unprecedented across the security landscape. Attackers did not wait for widespread analysis or public proof-of-concept code; they deployed automated exploit frameworks the same day the patch was released. Security monitoring firms observed threat actors using the path traversal flaw to write web shells into temporary directories, subsequently establishing persistent access by uploading malicious PHP scripts hosted on external repositories. This allowed them to bypass perimeter defenses and embed themselves directly into the host server.[2][3]

The underlying danger of CVE-2026-87902 lies in its complete lack of access barriers and the ease with which it can be triggered. The attack requires no WordPress account, no authentication cookie, no administrator interaction, and no vulnerable third-party plugin to function. Because the flaw resides deeply within the core software's template routing mechanisms, any visitor on the internet can send the malformed request directly to the application. This zero-click, unauthenticated nature makes it trivial to script into automated botnets that scan millions of domains simultaneously, looking for the specific combination of a vulnerable theme and a permissive PHP environment.[1][4]

In response to the severity of the flaw, the WordPress security team backported the fix to all maintained branches, releasing point updates for older versions down to 4.7.37 as a courtesy to administrators who cannot immediately upgrade to the 7.1 branch. In their official advisory, the maintainers stated, "Because this is a security release, it is recommended that you update your sites immediately." Sites with automatic background updates enabled received the patch without intervention, ensuring a baseline level of protection for standard installations.[3][5]

However, administrators managing manual update schedules are urged to apply the fixes immediately rather than relying on web application firewalls, which attackers are already attempting to bypass using double-encoded traversal sequences. The rapid exploitation of CVE-2026-87902 underscores a shifting timeline in vulnerability management. The window between a patch release and active exploitation has collapsed from weeks to mere hours, meaning that the presence of a vulnerable directory structure and a standard PHP configuration is enough to expose a site to automated compromise before an administrator has even read the release notes.[2][4]