WordPress has released security updates addressing a critical vulnerability in its core software that could allow unauthenticated attackers to make affected websites load PHP files from locations outside their normal theme directories.
Under certain server configurations, the vulnerability could potentially be escalated to remote code execution, giving attackers the ability to execute malicious code with the privileges of the web server.
The flaw, tracked as CVE-2026-87902, carries a CVSS score of 9.2 and was fixed on September 22 with WordPress 7.1.2 and corresponding updates for supported older branches.
Critical WordPress Core Vulnerability
The vulnerability affects the way WordPress determines which template file should be used when processing a webpage request.
According to the security disclosure, attackers can manipulate part of the requested URL to influence the PHP file WordPress attempts to load. The affected versions did not properly prevent directory traversal sequences in this particular code path.
Successful exploitation does not require an attacker to have a WordPress account or persuade a logged-in administrator to perform an action.
However, the vulnerability does not automatically result in complete code execution on every affected website. Additional conditions on the server and active theme can determine whether exploitation can be escalated.
WordPress Versions Affected
The vulnerability affects WordPress versions ranging from 4.7.0 through 7.1.1.
WordPress has issued fixes across its currently supported release branches. Site administrators should update according to the branch installed on their websites:
WordPress Branch
Recommended Update
7.1.x
7.1.2
7.0.x
7.0.6
6.9.x
6.9.9
6.8.x
6.8.10
6.7.x
6.7.9
6.6.x
6.6.9
The project has also backported the security fix to older supported branches, extending to version 4.7.37.
WordPress recommends that website administrators install the appropriate security release as soon as possible.
Automatic Updates Can Install the Fix
Websites with automatic background updates enabled may receive the security update automatically.
Administrators can also manually update WordPress through the dashboard by navigating to the Updates section or obtain the latest release through the official WordPress distribution channels.
Unlike some vulnerabilities that can be mitigated through configuration changes, WordPress has not provided a complete workaround for CVE-2026-87902. Updating the core software is therefore the primary recommended solution.
When Can the Flaw Lead to Code Execution?
The vulnerability allows WordPress to load a PHP file outside the expected theme directory structure. Loading such a file does not necessarily mean an attacker can execute arbitrary code.
For code execution to occur, the affected server must contain a PHP file that can perform useful actions when loaded and other conditions must also be present.
Researchers noted that the active WordPress theme can be an important factor. An exploitable configuration may require the theme to contain a top-level directory whose name begins with page-, along with a suitable PHP file.
Security researchers also highlighted the PHP configuration option register_argc_argv as another factor that can affect the possibility of escalating the vulnerability into code execution.
These conditions do not eliminate the vulnerability, but they can influence the severity of exploitation on individual installations.
Researcher Discovered the Vulnerability
WordPress credited security researcher Robert Ressl with discovering and responsibly reporting the vulnerability.
Ressl disclosed the issue privately through WordPress’s HackerOne security program in July. Following the release of the patch, he published technical details, including a proof-of-concept and a controlled testing environment.
His demonstration showed code execution under the privileges of the web-server account rather than unrestricted control over the underlying server.
The testing was conducted in isolated laboratory environments using an earlier WordPress release.
Temporary Risk Reduction Measures
For administrators unable to apply the update immediately, Ressl has suggested configuration changes that may reduce certain exploitation paths.
These include disabling register_argc_argv for web requests and removing unused PEAR components where they are not required.
However, these steps do not correct the underlying WordPress vulnerability and should not be considered a replacement for installing the official security update.
No Known Exploitation Reported
As of September 22, there were no reported incidents indicating that CVE-2026-87902 had been actively exploited in the wild.
The vulnerability also had not been listed in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog at that time.
Despite the absence of known attacks, WordPress administrators are advised to prioritize the security update because the vulnerability affects a large number of versions and technical exploitation details are now publicly available.
