CVE-2026-87902 in WordPress Enables Conditional RCE

Security updates released for WordPress address CVE-2026-87902, a severe unauthenticated path traversal flaw within its page-template resolution mechanism. The weakness allows the CMS to load arbitrary readable PHP files outside designated theme directories, potentially resulting in Remote Code Execution (RCE) under tailored server and theme setups.

On September 22, 2026, WordPress issued version 7.1.2 alongside backported fixes for earlier releases, accompanying public documentation of the exploitation conditions and proof-of-concept (PoC) code. Threat actors capitalized swiftly, with Patchstack observing initial probing activity within five hours of release.

The affected range spans WordPress versions 4.7.0 to 7.1.1.

What Is CVE-2026-87902?

CVE-2026-87902 is an unauthenticated path traversal vulnerability in WordPress Core’s page-template resolution process. It is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.

In vulnerable installations, request-derived page information can influence the filename WordPress attempts to resolve as a template. Insufficient handling of encoded traversal elements can cause the template loader to reach a readable PHP file outside the expected theme directories.

The vulnerability carries a CVSS 4.0 score of 9.2 (Critical). No authentication or user interaction is required, although additional environmental conditions must be present to reach the highest-impact outcome.

The immediate vulnerability is therefore better understood as local file inclusion (LFI) with a conditional path to RCE, rather than universal unauthenticated RCE against every vulnerable WordPress installation.

Which WordPress Versions Are Affected?

CVE-2026-87902 affects WordPress 4.7.0 through 7.1.1. WordPress backported the security fix across branches eligible for security updates.

WordPress 4.6 and earlier no longer receive security backports. Organizations still running those releases should migrate to a supported version rather than relying on an unavailable branch-specific fix.

How Does CVE-2026-87902 Work?

The vulnerable component is WordPress Core’s page-template resolution logic in /wp-includes/template.php, which was revised in the September 22 security update.

When WordPress renders a page, it constructs candidate template filenames using page information derived from the request. The vulnerability allowed encoded traversal content to influence this process in a way that could move template resolution outside the expected theme directories.

This can result in WordPress including another readable local PHP file.

When Can the Flaw Lead to RCE?

The path from file inclusion to remote code execution requires additional conditions.

One relevant factor is the active parent or child theme. Research into the vulnerability identified theme layouts containing a top-level directory beginning with page-, such as page-templates, as an important prerequisite.

The server must also contain a suitable readable PHP file whose behavior can be abused when included. Published research demonstrated one possible route involving pearcmd.php when the PHP setting register_argc_argv is enabled.

These conditions are not present on every WordPress server. Hosting configuration, filesystem permissions, PHP settings, theme structure, and isolation therefore have a significant effect on practical exploitability.

If code execution is achieved, the initial process would run with the privileges available to the web-server account. What an attacker could do next would depend on the permissions and isolation of that environment.

Is There a Public PoC for CVE-2026-87902?

Yes. Researcher Robert Ressl, who reported the vulnerability to WordPress, published a PoC and reproducible laboratory environment on GitHub on September 22 after the security update became available. A technical write-up for CVE-2026-87902 is also available on the researcher’s blog.

The research documents the vulnerability’s prerequisites and demonstrates the path from template traversal to local file inclusion and, under the required conditions, code execution.

A public PoC lowers the barrier for reproducing the vulnerability, but it does not mean every affected WordPress site is directly exploitable for RCE. The theme and server prerequisites still apply.

Is CVE-2026-87902 Being Exploited?

Active probing is confirmed, but successful RCE in the wild has not been confirmed.

Patchstack detected the first probing attempts at 17:44 UTC on September 22, less than five hours after WordPress 7.1.2 was released. The requests used encoding patterns associated with the vulnerability and attempted to include ordinary WordPress Core PHP files.

Patchstack characterized the activity as reconnaissance rather than payload delivery. The observed requests could help attackers determine whether a site is vulnerable, but do not by themselves provide code execution or prove compromise.

The rapid scanning shows that attackers began testing internet-facing WordPress installations within hours of disclosure. Organizations should treat matching activity as a sign of potential exposure and investigate further, while avoiding assumptions that a probe means the site was successfully exploited.

Track CVE-2026-87902 with SOCRadar

With public PoC code available and probing already observed, CVE-2026-87902 is likely to remain relevant as attackers continue identifying exposed WordPress installations.

SOCRadar’s Cyber Threat Intelligence (CTI) module provides updated vulnerability details, exploitation status, severity data, and related threat intelligence to help teams follow developments around CVE-2026-87902. Combined with Attack Surface Management (ASM), organizations can identify internet-facing assets affected by known vulnerabilities and prioritize exposed systems that require attention.

For CVE-2026-87902, this visibility can help teams move from tracking the vulnerability to identifying potentially exposed WordPress assets and prioritizing remediation as the threat landscape changes.

What Should Defenders Do About CVE-2026-87902?

Patch Affected WordPress Sites

Updating WordPress is the primary remediation. Organizations should:

• Upgrade to the fixed release for the installed WordPress branch.
• Verify the running version after deployment, including on production, staging, and development sites.
• Prioritize internet-facing sites and those using older or customized third-party themes.
• Migrate WordPress 4.6 and earlier to a supported release.

Automatic background updates may already have deployed the fix on eligible sites, but administrators should confirm the installed version.

Assess RCE Preconditions

Review active parent and child themes for relevant top-level page- directories and check PHP configuration, particularly register_argc_argv. Teams should also look for unnecessary PHP components and determine whether the web-server account can read files beyond those required by the application.

These conditions can help assess pre-patch exposure but do not replace updating WordPress.

Hunt for Probing and Suspicious Activity

Review web-server, WAF, CDN, and hosting logs from September 22 onward for unusual encoded traversal sequences, suspicious page parameters, and requests that return content from unrelated WordPress Core files.

Matching activity indicates probing or attempted exploitation, not necessarily successful RCE. Sites showing these patterns should also be checked for modified PHP files, unexpected files in writable directories, unfamiliar administrator accounts, and unauthorized theme or plugin changes.

Reduce Exposure if Patching Is Delayed

If immediate patching is not possible, consider blocking suspicious traversal patterns at the WAF or CDN, disabling register_argc_argv for web requests where appropriate, removing unnecessary PEAR components, and tightening web-server filesystem permissions.

These controls may reduce exposure but do not replace the WordPress security update.