CVSS 4.0 severity score: 9.2 (Source: Patchstack (September 22, 2026))
A Validation Check That Was Missing for Nearly a Decade
WordPress shipped version 7.1.2 on September 22, 2026, a security-only release built around a single fix. According to Patchstack, the vulnerability it closes is an unauthenticated local file inclusion in how WordPress resolves page templates, one that can be escalated to remote code execution under common server configurations. The bug, reported by researcher Robert Ressl, has been assigned CVE-2026-87902 and classified as CWE-98, improper control of filename for an include statement.
Where the Check Was Skipped
Patchstack's technical breakdown traces the flaw to get_page_template() in wp-includes/template.php. WordPress builds a list of candidate template filenames when rendering a page, and one candidate is built directly from the pagename value in the request URL. A sibling code path runs that value through validate_file(), WordPress's own traversal check, before accepting it. The pagename branch never did. Reaching full code execution additionally requires a readable PHP file that behaves usefully when included, a role Patchstack says PEAR's pearcmd.php can fill when the PHP setting register_argc_argv is enabled, which it says is on by default in the official PHP Docker images and in cPanel environments running PHP versions below 8.5.
Who Is Exposed
Patchstack notes the vulnerability requires no account to attack and reaches back through every WordPress branch it still backports fixes to, meaning older self-hosted sites can apply the patch without a major version upgrade. Exploitation also depends on the active theme having a top-level directory whose name begins with page- (such as page-templates), a pattern Patchstack says appears in legacy default themes and a number of popular third-party themes. Independent of this specific CVE, NIST NVD data shows WordPress core has logged 2 CVEs in the past 12 months against 583 total on record, underscoring how infrequently a core vulnerability of this severity surfaces.
Scale of the Installed Base
The patch's reach is amplified by how widely WordPress core still runs. A WebPulse scan of the Tranco top-10,000 domains in September 2026 found WordPress on 719 of 2,491 sites where a platform was identified, the largest single share after Next.js. Patchstack says WordPress has published fixed releases for every supported branch and that sites with automatic background updates enabled should already be running 7.1.2; only the current version remains actively supported.
What to Ask Before the Next Review
Patchstack's writeup adds that WordPress paired the specific fix with a broader containment check requiring every resolved template path to sit inside the stylesheet directory, template directory, or theme-compat folder, regardless of which code path produced it. For a budget-holder, the immediate questions are narrower: has every WordPress instance in the environment, including older maintained branches, actually been moved to 7.1.2; does the active theme on any of those sites contain a directory whose name starts with page-; and is register_argc_argv enabled on the PHP configuration in use. None of those three checks requires a developer to answer, but each changes how exposed a given site actually is.
