Threat feed
CVE-2026-87902 — Unauthenticated file inclusion in WordPress core (conditional RCE): explainer and fix
CVE-2026-87902: unauthenticated file inclusion in WordPress core page-template resolution (CWE-98), RCE under conditions. Fixed 22 Sep in 7.1.2 and backported to 4.7; in CISA KEV since 25 Sep.
This is a rapid explainer for a vulnerability that is being actively exploited (listed in CISA KEV). It covers what happens, who is affected and how to respond — from the defender's side, with no reproduction steps.
- CVE
- CVE-2026-87902 (GHSA-7hp8-65ch-5whp)
- Severity
- NVD: CVSS v3.1 8.1 (attack complexity high) / WordPress advisory: CVSS v4.0 9.2, Critical
- Type
- File inclusion (CWE-98) — path traversal in page-template resolution
- Impact
- Inclusion of .php files outside the theme; RCE when theme and server conditions line up
- Preconditions
- No authentication, no user interaction
- Affected
- WordPress 4.7.0–7.1.1
- Fix
- 7.1.2, released 22 September 2026, with fixes for every branch back to 4.7
- Exploitation
- In CISA KEV (added 25 September 2026, remediation due 28 September), flagged as requiring forensic triage
How dangerous is it to wait?
WordPress is the most widely used CMS, and this flaw spans roughly ten years of releases, with no authentication and no user interaction required. A WordPress-focused security firm reports that probing began the day the fix shipped, moved to code-execution attempts by the next day, and was folded into general-purpose scanning tools. Scanning is indiscriminate; the size of your site is irrelevant.
What kind of flaw is it?
WordPress decides which template file renders a page by looking it up in the theme directories. According to the advisory, that page-template resolution had a gap: an unauthenticated attacker could make it include a .php file outside the active theme's directories. When an outside value decides which file gets loaded, that is file inclusion (CWE-98). This site does not describe how it is exploited.
On its own that is not code execution. The advisory splits the conditions for RCE into a theme side and a server side.
Theme-side condition (per the advisory)
- The active parent or child theme has a top-level directory whose name starts with
page-(for examplepage-templates) - The advisory says this applies to the legacy Twenty Twelve and Twenty Fourteen themes and to some popular third-party themes such as Neve, Hestia and Sydney (the flaw is in core's handling, not in the themes)
Server-side condition (per the advisory)
- A .php file that behaves dangerously when included exists on the server and is readable by the web server account
- PHP's
register_argc_argvbeing on makes this condition much easier to meet - The advisory says the official PHP Docker image and the default cPanel configuration with PHP older than 8.5 are affected
① Core flaw: .php outside the theme can be included
→ fixed in 7.1.2 (and each branch's release)
② Theme condition: a directory starting with page-
→ hard to know for yourself; do not rely on judging it
③ Server condition: a dangerous .php is readable and register_argc_argv is on
→ turning the setting off blunts the whole class of attack
Who is affected
| Branch | Affected | Fixed |
|---|---|---|
| 7.1 | 7.1.0–7.1.1 | 7.1.2 |
| 7.0 | 7.0.0–7.0.5 | 7.0.6 |
| 6.9 | 6.9.0–6.9.8 | 6.9.9 |
| 6.8 | 6.8.0–6.8.9 | 6.8.10 |
| 6.7 to 4.7 | up to the release before each branch's fix | each branch's fix (6.7.9 … 4.7.37) |
| Before 4.7 | — | No fix (unsupported) |
What to do
Check your version and move to the fixed release (first, and the real fix)
In the dashboard, go to Dashboard → Updates and check the version. If it is not 7.1.2 (or your branch's fixed release), update today. Only the latest version is actively supported, so 7.1.2 is the safest target.
Find the sites automatic updates don't reach
On sites that support background updates, the update starts by itself. The risk is sites outside that path: auto-updates disabled, core pinned in Git or a container image (update it and a rebuild quietly puts the old version back), updates blocked by the host, and the old site nobody remembers. If you run several sites, check each one (security inventory checklist).
Turn off PHP's register_argc_argv (defense in depth)
PHP serving web requests almost never needs this setting. Set register_argc_argv = Off in php.ini (or your host's PHP settings); if you run in containers, check the image's configuration. It does not replace the update, but it cuts off a route from file inclusion to code execution that goes well beyond this one CVE.
Check whether you were entered before updating
If a site stayed unpatched after 22 September, treat that window as suspect; CISA also flags this CVE for forensic triage. At minimum check: (1) unfamiliar .php files in /tmp, /var/tmp or under wp-content; (2) access-log requests containing percent-encoded directory traversal (the equivalent of ../); (3) admin users or recently added plugins you do not recognise.
If anything looks wrong, don't stop at 'patched'
If code may have run, the patch does not remove files already planted or keys already taken. Rotate the database password and auth keys/salts in wp-config.php, admin passwords and third-party API keys, and remove suspicious files. The full process is in the vulnerability remediation playbook and WordPress security.
This site's view: publishing a fix is also the starting gun
In the recent Adobe Commerce case, 44 days passed between the fix and KEV. Here it was three. The difference is how readily the patch diff reveals the attack, and how many sites run the product. By the reported timeline, probing shaped like the diff started the same day the fix shipped.
The lesson: for a widely used product, a fix is not a grace period — it is a race from the moment it is published, and humans struggle to win that race by hand. That is why this site ranks keeping automatic updates reliably flowing above patch process itself. Sites that received the auto-update were covered before their owners knew anything happened. The sites at risk are the ones that do not realise they sit outside auto-updates.
One more point: EPSS was 3%. EPSS is useful, but it lags for freshly disclosed flaws. When KEV and EPSS disagree, go with KEV — it is the confirmed fact.
Sources
- WordPress — GHSA-7hp8-65ch-5whp (affected and fixed versions, RCE preconditions, CVSS v4.0 9.2)
- WordPress.org — WordPress 7.1.2 Release (22 September 2026; backports to 4.7, automatic updates)
- NVD — CVE-2026-87902 (CWE-98, CVSS v3.1 8.1)
- CISA KEV — Known Exploited Vulnerabilities Catalog (added 25 September 2026, due 28 September, forensic triage required)
- FIRST — EPSS (0.029 on 25 September 2026)
- Observation report — Patchstack (probing from the day of the fix, code-execution attempts the next day; this article uses only the timeline and defender-side checks)
Read next
- Practice: WordPress security / The vulnerability remediation playbook
- Deciding: Prioritising with CVSS, EPSS and KEV
- The contrasting case: CVE-2026-71362 (Adobe Commerce: KEV 44 days after the fix)
- Terms: What is RCE? / What is path traversal?
FAQ
QWhat does CVE-2026-87902 allow?
According to WordPress's advisory, an unauthenticated attacker can make page-template resolution (get_page_template) include a chosen readable local .php file outside the active theme directories. When preconditions in both the server environment and the active theme are met, this leads to remote code execution. CISA added it to KEV on 25 September 2026 after confirming active exploitation.
QWhich versions are affected, and what do I update to?
4.7.0 through 7.1.1. Fixes exist for every branch — 7.1.2, 7.0.6, 6.9.9, 6.8.10 and so on back to 4.7.37. Branches older than 4.7 get no fix. Only the latest version is actively supported, so moving to 7.1.2 is the safest choice.
QIf automatic updates are on, am I covered?
On sites that support automatic background updates, the update starts on its own. It does not reach sites where auto-updates are disabled, where core is pinned in Git or a container image, or where the host blocks updates. Check the version in your dashboard.
QIf I don't use one of the listed themes, am I safe?
The advisory says RCE requires both a theme-side and a server-side condition. But either the parent or the child theme can meet the theme condition, and few site owners know their theme's directory layout. Updating is faster and more certain than working out whether you qualify.
QEPSS is only 3% — why is this urgent?
EPSS is a model that estimates the chance of exploitation over the next 30 days from historical data, and it can lag behind reality for freshly disclosed flaws. KEV records confirmed exploitation. When they disagree, go with KEV.