- WordPress released version 7.1.2 on September 22, 2026 to fix CVE-2026-87902, a 9.2-severity flaw that, per Patchstack, lets attackers without an account include files and possibly run code.
- Patchstack says the flaw affects every WordPress branch from 4.7.0 through 7.1.1, but exploiting it needs a theme folder starting with page- and, for code execution, a specific PHP setting.
- Check that every WordPress site, including older maintained branches, is on 7.1.2, whether its theme has a page- folder, and whether register_argc_argv is enabled in PHP.
A Validation Check That Was Missing for Nearly a Decade
WordPress shipped version 7.1.2 on September 22, 2026, a security-only release built around a single fix. According to Patchstack, the vulnerability it closes is an unauthenticated local file inclusion in how WordPress resolves page templates, one that can be escalated to remote code execution under common server configurations. Security researcher Robert Ressl reported the issue, which now carries the identifier CVE-2026-87902 and falls under CWE-98, the weakness category covering include statements that fail to properly restrict the filename they load.
Where the Check Was Skipped
Patchstack traces the root cause to a single function, get_page_template(), inside the core file wp-includes/template.php. WordPress builds a list of candidate template filenames when rendering a page, and one candidate is built directly from the pagename value in the request URL. A sibling code path runs that value through validate_file(), WordPress's own traversal check, before accepting it. The pagename branch never did. Turning that gap into full code execution takes one more ingredient: a readable PHP file already on the server that does something useful when pulled in this way. Patchstack points to PEAR's pearcmd.php as a known fit, but only when the PHP setting register_argc_argv is switched on — a default state in the official PHP Docker images and in cPanel environments running PHP versions older than 8.5.
Who Is Exposed
Patchstack notes the vulnerability requires no account to attack and reaches back through every WordPress branch it still backports fixes to, meaning older self-hosted sites can apply the patch without a major version upgrade. There is also a theme-level precondition: the active theme needs a top-level folder whose name starts with page- (page-templates is the common example). Patchstack notes this naming pattern turns up in older default WordPress themes as well as a number of widely used third-party themes. Independent of this specific CVE, NIST NVD data shows WordPress core has logged 2 CVEs in the past 12 months against 583 total on record, underscoring how infrequently a core vulnerability of this severity surfaces.
Scale of the Installed Base
The patch's reach is amplified by how widely WordPress core still runs. A WebPulse scan of the Tranco top-10,000 domains in September 2026 found WordPress on 719 of 2,491 sites where a platform was identified, the largest single share after Next.js. Because the flaw reaches back nearly a decade, WordPress backported fixed releases to every branch it still maintains, per Patchstack, so sites with automatic background updates switched on should already be running 7.1.2. Patchstack notes that only the current release line remains actively supported.
What to Ask Before the Next Review
Patchstack's writeup adds that WordPress paired the specific fix with a broader containment check requiring every resolved template path to sit inside the stylesheet directory, template directory, or theme-compat folder, regardless of which code path produced it. For a budget-holder, the immediate questions are narrower: has every WordPress instance in the environment, including older maintained branches, actually been moved to 7.1.2; does the active theme on any of those sites contain a directory whose name starts with page-; and is register_argc_argv enabled on the PHP configuration in use. None of those three checks requires a developer to answer, but each changes how exposed a given site actually is.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Patchstack.
