A critical security vulnerability in WordPress could allow an unauthenticated attacker to abuse page-template resolution to include a locally accessible PHP file outside the active theme directory, potentially leading to remote code execution (RCE) under specific server and theme configurations.
The vulnerability, tracked as CVE-2026-87902 and identified in GitHub’s advisory database as GHSA-7hp8-65ch-5whp, was disclosed by security researcher Robert Ressl and publicly documented by the WordPress project on September 22, 2026. WordPress rates the issue as Critical, with a CVSS v4 score of 9.2.
WordPress security advisory on GitHub
What is the vulnerability?
The issue resides in WordPress’s page-template resolution mechanism. According to the WordPress advisory, an attacker who does not need to authenticate can influence get_page_template() so that template resolution attempts to include a chosen, readable local .php file located outside the active theme directories.
On its own, local PHP file inclusion does not necessarily mean that every vulnerable WordPress installation can immediately be taken over. The advisory stresses that additional conditions must be present for the issue to become an RCE.
Those conditions involve both the WordPress theme and the underlying PHP/server environment.
Specific themes can expose the vulnerable code path
One prerequisite is that the active parent or child theme contains a top-level directory beginning with page-.
The WordPress security team specifically identifies examples including the legacy Twenty Twelve and Twenty Fourteen themes, along with third-party themes such as Neve, Hestia and Sydney.
This means that simply running an affected WordPress version does not, by itself, establish that a site is exploitable for RCE. Administrators should instead examine both their WordPress version and the structure of the active theme.
Server configuration can determine whether RCE is possible
The second major prerequisite is the presence of a suitable local PHP file that is readable by the web server account.
The advisory notes that pearcmd.php can provide a path from local PHP inclusion to code execution in environments where PHP’s register_argc_argv setting is enabled. The WordPress project specifically calls out the official PHP Docker image and default cPanel configurations using PHP versions before 8.5 as environments that can satisfy relevant conditions.
Consequently, the practical risk varies considerably between deployments. A vulnerable WordPress installation may be exposed to the path-traversal/file-inclusion component without necessarily meeting all the requirements for remote code execution.
Broad range of WordPress versions affected
The vulnerability has an unusually broad affected-version range.
According to the WordPress advisory, affected releases span from the 4.7 branch through the 7.1.1 release, with each maintained branch having its own affected version range.
The corresponding fixed releases include:
| Branch | Fixed version |
|---|---|
| 7.1 | 7.1.2 |
| 7.0 | 7.0.6 |
| 6.9 | 6.9.9 |
| 6.8 | 6.8.10 |
| 6.7 | 6.7.9 |
| 6.6 | 6.6.9 |
| 6.5 | 6.5.12 |
| 6.4 | 6.4.12 |
| 6.3 | 6.3.12 |
| 6.2 | 6.2.13 |
| 6.1 | 6.1.14 |
| 6.0 | 6.0.16 |
| 5.9 | 5.9.18 |
| 5.8 | 5.8.17 |
| 5.7 | 5.7.19 |
| 5.6 | 5.6.21 |
| 5.5 | 5.5.22 |
| 5.4 | 5.4.23 |
| 5.3 | 5.3.25 |
| 5.2 | 5.2.28 |
| 5.1 | 5.1.26 |
| 5.0 | 5.0.29 |
| 4.9 | 4.9.33 |
| 4.8 | 4.8.32 |
| 4.7 | 4.7.37 |
The project says the fix was backported to branches as far back as WordPress 4.7 as a courtesy to users of older releases.
WordPress urges immediate updates
WordPress 7.1.2 was released on September 22 as a security release specifically addressing this critical vulnerability. The official WordPress announcement recommends that administrators update affected sites immediately. Sites supporting automatic background updates may receive the update automatically.
WordPress 7.1.2 release announcement
The WordPress documentation also confirms that security fixes were made available across the older supported branches.
What administrators should do
Administrators should first determine whether their WordPress installation is running one of the affected versions and update to the corresponding fixed release.
Organizations managing large WordPress fleets should also identify installations using themes with top-level page-* directories and review PHP/server configurations that could satisfy the additional conditions described in the advisory.
Because the vulnerability does not require authentication and the potential impact includes confidentiality, integrity and availability compromise when the necessary conditions are met, delaying the security update increases exposure.
The WordPress project credits Robert Ressl for discovering and responsibly disclosing the vulnerability.
Bottom line
CVE-2026-87902 is not a universal one-click RCE affecting every WordPress installation. Exploitation to achieve code execution depends on a combination of an affected WordPress release, a qualifying theme structure, and particular server/PHP conditions.
Nevertheless, the combination of unauthenticated access, path traversal, local PHP file inclusion and the possibility of RCE makes the issue significant. WordPress has released fixes across a wide range of branches, with 7.1.2 serving as the current fix for the 7.1 branch.
Administrators should prioritize upgrading rather than attempting to mitigate the issue solely through theme or server configuration changes.
