Skip to content
ITDWeb Security Platform
ITD
Search

Threat feed

CriticalCVSS8.1#CVE-2026-87902#WordPress#file inclusion#RCE#PHP

CVE-2026-87902 — Unauthenticated file inclusion in WordPress core (conditional RCE): explainer and fix

CVE-2026-87902 is unauthenticated file inclusion in WordPress core (CWE-98) with conditional RCE. Fixed 22 Sep in 7.1.2 and back to 4.7; in KEV since 25 Sep.

Published 2026-09-26 Updated 2026-10-04 Last verified 2026-10-05 9 min read
On this page

This is a rapid explainer for a vulnerability that is being actively exploited (listed in CISA KEV). It covers what happens, who is affected and how to respond — from the defender's side, with no reproduction steps.

Advisory summary
CVE
CVE-2026-87902 (GHSA-7hp8-65ch-5whp)
Severity
NVD: CVSS v3.1 8.1 (attack complexity high) / WordPress advisory: CVSS v4.0 9.2, Critical
Type
File inclusion (CWE-98) — path traversal in page-template resolution
Impact
Inclusion of .php files outside the theme; RCE when theme and server conditions line up
Preconditions
No authentication, no user interaction
Affected
WordPress 4.7.0–7.1.1
Fix
7.1.2, released 22 September 2026, with fixes for every branch back to 4.7
Exploitation
In CISA KEV (added 25 September 2026, remediation due 28 September), flagged as requiring forensic triage
4.7–7.1.1
Affected versions (about ten years of releases)
No auth
What an attacker needs
3 days
From fix (22 Sep) to KEV listing (25 Sep)
3%
EPSS on 25 Sep — at odds with KEV

How dangerous is it to wait?

WordPress is the most widely used CMS, and this flaw spans roughly ten years of releases, with no authentication and no user interaction required. A WordPress-focused security firm reports that probing began the day the fix shipped, moved to code-execution attempts by the next day, and was folded into general-purpose scanning tools. Scanning is indiscriminate; the size of your site is irrelevant.

What kind of flaw is it?

WordPress decides which template file renders a page by looking it up in the theme directories. According to the advisory, that page-template resolution had a gap: an unauthenticated attacker could make it include a .php file outside the active theme's directories. When an outside value decides which file gets loaded, that is file inclusion (CWE-98). This site does not describe how it is exploited.

On its own that is not code execution. The advisory splits the conditions for RCE into a theme side and a server side.

Theme-side condition (per the advisory)

  • The active parent or child theme has a top-level directory whose name starts with page- (for example page-templates)
  • The advisory says this applies to the legacy Twenty Twelve and Twenty Fourteen themes and to some popular third-party themes such as Neve, Hestia and Sydney (the flaw is in core's handling, not in the themes)

Server-side condition (per the advisory)

  • A .php file that behaves dangerously when included exists on the server and is readable by the web server account
  • PHP's register_argc_argv being on makes this condition much easier to meet
  • The advisory says the official PHP Docker image and the default cPanel configuration with PHP older than 8.5 are affected

① Core flaw: .php outside the theme can be included

→ fixed in 7.1.2 (and each branch's release)

② Theme condition: a directory starting with page-

→ hard to know for yourself; do not rely on judging it

③ Server condition: a dangerous .php is readable and register_argc_argv is on

→ turning the setting off prevents the whole class of attack

RCE needs all three: the core flaw, the theme condition and the server condition. Updating removes the first; changing the configuration removes the third.

Who is affected

BranchAffectedFixed
7.17.1.0–7.1.17.1.2
7.07.0.0–7.0.57.0.6
6.96.9.0–6.9.86.9.9
6.86.8.0–6.8.96.8.10
6.7 to 4.7up to the release before each branch's fixeach branch's fix (6.7.9 … 4.7.37)
Before 4.7—No fix (unsupported)

What to do

1

Check your version and move to the fixed release (first priority)

In the dashboard, go to Dashboard → Updates and check the version. If it is not 7.1.2 (or your branch's fixed release), update today. Only the latest version is actively supported, so 7.1.2 is the safest target.

2

Find the sites automatic updates don't reach

On sites that support background updates, the update starts by itself. The risk is sites outside that path: auto-updates disabled, core pinned in Git or a container image (update it and a rebuild puts the old version back without warning), updates blocked by the host, and the old site nobody remembers. If you run several sites, check each one (security inventory checklist).

3

Turn off PHP's register_argc_argv (defense in depth)

PHP serving web requests almost never needs this setting. Set register_argc_argv = Off in php.ini (or your host's PHP settings); if you run in containers, check the image's configuration. It does not replace the update, but it cuts off a route from file inclusion to code execution that goes well beyond this one CVE.

4

Check whether you were entered before updating

If a site stayed unpatched after 22 September, treat that window as suspect; CISA also flags this CVE for forensic triage. At minimum check: (1) unfamiliar .php files in /tmp, /var/tmp or under wp-content; (2) access-log requests containing percent-encoded directory traversal (the equivalent of ../); (3) admin users or recently added plugins you do not recognise.

5

If anything looks wrong, don't stop at 'patched'

If code may have run, the patch does not remove files already placed on the server or keys already stolen. Rotate the database password and auth keys/salts in wp-config.php, admin passwords and third-party API keys, and remove suspicious files. The full process is in the vulnerability remediation playbook and WordPress security.

This site's view: once a fix is published, attacks start right away

In the recent Adobe Commerce case, 44 days passed between the fix and KEV. Here it was three. The difference is how readily the patch diff reveals the attack, and how many sites run the product. By the reported timeline, probing shaped like the diff started the same day the fix shipped.

The lesson: for a widely used product, a fix does not give you extra time. Attackers start working on it the moment it is published, and it is hard for people to keep up with that by hand. That is why this site ranks making sure automatic updates reliably arrive above patch process itself. Sites that received the auto-update were covered before their owners knew anything happened. The sites at risk are the ones that do not realise they sit outside auto-updates.

One more point: EPSS was 3%. EPSS is useful, but it lags for freshly disclosed flaws. When KEV and EPSS disagree, go with KEV — it is the confirmed fact.

Sources

  • WordPress — GHSA-7hp8-65ch-5whp (affected and fixed versions, RCE preconditions, CVSS v4.0 9.2)
  • WordPress.org — WordPress 7.1.2 Release (22 September 2026; backports to 4.7, automatic updates)
  • NVD — CVE-2026-87902 (CWE-98, CVSS v3.1 8.1)
  • CISA KEV — Known Exploited Vulnerabilities Catalog (added 25 September 2026, due 28 September, forensic triage required)
  • FIRST — EPSS (0.029 on 25 September 2026)
  • Observation report — Patchstack (probing from the day of the fix, code-execution attempts the next day; this article uses only the timeline and defender-side checks)

FAQ

QWhat does CVE-2026-87902 allow?
A

According to WordPress's advisory, an unauthenticated attacker can make page-template resolution (get_page_template) include a chosen readable local .php file outside the active theme directories. When preconditions in both the server environment and the active theme are met, this leads to remote code execution. CISA added it to KEV on 25 September 2026 after confirming active exploitation.

QWhich versions are affected, and what do I update to?
A

4.7.0 through 7.1.1. Fixes exist for every branch — 7.1.2, 7.0.6, 6.9.9, 6.8.10 and so on back to 4.7.37. Branches older than 4.7 get no fix. Only the latest version is actively supported, so moving to 7.1.2 is the safest choice.

QIf automatic updates are on, am I covered?
A

On sites that support automatic background updates, the update starts on its own. It does not reach sites where auto-updates are disabled, where core is pinned in Git or a container image, or where the host blocks updates. Check the version in your dashboard.

QIf I don't use one of the listed themes, am I safe?
A

The advisory says RCE requires both a theme-side and a server-side condition. But either the parent or the child theme can meet the theme condition, and few site owners know their theme's directory layout. Updating is faster and more certain than working out whether you qualify.

QEPSS is only 3% — why is this urgent?
A

EPSS is a model that estimates the chance of exploitation over the next 30 days from historical data, and it can lag behind reality for freshly disclosed flaws. KEV records confirmed exploitation. When they disagree, go with KEV.