CVE-2026-87902
Summary
An unauthenticated path-traversal flaw in WordPress core that can become remote code execution under specific theme and server conditions, patched in WordPress 7.1.2 on 22 September 2026 and backported to every branch down to 4.7. The WordPress security team assessed it at 9.2 (Critical); NVD records CVSS 3.1 8.1 (High). Attackers moved from reconnaissance to exploitation within hours of the patch and were writing payloads to disk the following day.
Details
The flaw lets an unauthenticated attacker make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. For RCE, two preconditions apply: the active parent or child theme must have a top-level directory whose name begins with page- (for example page-templates), and the included file must be readable by the web server account — the advisory's example is pearcmd.php when PHP's register_argc_argv setting is active. The official Docker PHP image is affected, as is a default cPanel configuration running PHP below 8.5.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-87902 |
| CVSS | 8.1 (NVD, CVSS 3.1); WordPress security team assessed 9.2 — Critical |
| Vendor / product | WordPress core (fixed in 7.1.2; backports to 4.7) |
| Reported | 22 September 2026 (patch); exploitation observed from 22–23 September |
Exploitation and indicators
Patchstack observed the first malicious requests at 17:44 UTC on 22 September, less than five hours after the patch, from a small group of IP addresses, and reported a tenfold increase in traffic the following day including a disk-write stage. Observed probes use double-encoded traversal sequences in the pagename parameter alongside a valid page_id. Payloads written include wp-pear-rce-flag.php, poc87902.php, luci_<random>.php and zeta_<random>.php, delivered to /tmp and /var/tmp; some payloads merely mark the host as exploitable, while others write a short tag that executes a shell command on access. Blocklist addresses published by Patchstack: 169.58.48.193, 169.58.48.195 and 2001:df1:e8c0::106b.
Australian Significance
WordPress runs a substantial share of Australian small-business, not-for-profit and government-adjacent web presence, frequently on cPanel-based shared hosting where the default PHP version below 8.5 satisfies one of the RCE preconditions. Releases before 4.6 will not receive a fix, so any site pinned to an unsupported branch is permanently exposed; where patching cannot be immediate, blocking the published addresses and confirming the active theme has no top-level page-* directory removes the RCE path while leaving the traversal itself.