Update WordPress Immediately — Exploitation Attempts Already Underway
WordPress released an emergency security update on September 22, 2026, patching a critical unauthenticated path traversal vulnerability tracked as CVE-2026-87902. With a CVSS v4.0 score of 9.2 (Critical), this flaw affects every WordPress installation from version 4.7.0 through 7.1.1 — and active probing began within hours of public disclosure.
What Is CVE-2026-87902?
The vulnerability exists in how WordPress Core resolves templates for pages. Attacker-controlled data used during this process is not sufficiently constrained before being incorporated into the page-template path. A crafted request can introduce directory traversal sequences and cause WordPress to resolve a PHP file that resides outside the expected active-theme directories — without any authentication required.
Security researcher Robert Ressl discovered and responsibly disclosed the flaw. WordPress acknowledged the report on July 21, 2026, and released the patch on September 22, 2026.
Which Sites Are Most at Risk?
While the path traversal primitive itself is unauthenticated and affects all vulnerable installs, full Remote Code Execution (RCE) requires two additional conditions:
- The active theme must contain a top-level directory whose name begins with page- (e.g., page-templates in Twenty Twelve, Twenty Fourteen, Neve, Hestia, or Sydney themes)
- A readable .php file must exist on the server accessible to the web-server account (e.g., pearcmd.php with register_argc_argv=On, as found in the official PHP Docker image and default cPanel setups on PHP less than 8.5)
Affected Versions
CVE-2026-87902 affects WordPress Core versions 4.7.0 through 7.1.1, including all maintained branches back to WordPress 4.7.36. Note: WordPress 7.1.1, released just five days earlier as a security update, remains vulnerable to this separate issue.
Active Exploitation Attempts Already Detected
Patchstack reported detecting the first probing attempts at approximately 17:44 UTC on September 22 — less than five hours after WordPress 7.1.2 became available. The observed requests matched the encoding addressed by the patch, indicating rapid analysis of the security diff by threat actors. A public proof-of-concept (PoC) is also now available.
How to Fix It: Update to WordPress 7.1.2 Now
The fix is available in WordPress 7.1.2, with security backports released for every maintained branch down to WordPress 4.7.37.
- Log in to your WordPress admin dashboard
- Navigate to Dashboard then Updates
- Click Update Now to install WordPress 7.1.2
- Verify the update completed successfully
Additional Hardening Steps
- Check whether PHP is running with register_argc_argv = On and disable it if not needed
- Audit your server for readable PEAR components such as pearcmd.php
- Review WAF rules — Wordfence Premium customers received a firewall rule on September 22
- Monitor web server and WAF logs for path traversal patterns
Key Takeaways
- Update to WordPress 7.1.2 immediately — this is not a routine maintenance update
- This is the fifth WordPress Core security release since July 2026
- Exploitation attempts began within hours of disclosure — do not delay patching
- Even without full RCE conditions, the unauthenticated file inclusion is a critical security boundary violation
Hashtags: #WordPress #WebSecurity #CVE202687902 #WordPressSecurity #WebDevelopment #CyberSecurity #PatchNow
Sources: