Overview
- WordPress released security update 7.1.2 on Tuesday, September 22 to fix CVE-2026-87902, a path-traversal bug that lets an unauthenticated request force inclusion of a local .php file.
- Researchers observed probes within hours of the disclosure that quickly moved from reconnaissance to active exploitation where attackers write attacker-controlled PHP files into /tmp and /var/tmp.
- Full remote code execution depends on three conditions: an active theme with a top-level folder starting with "page-", a readable local PHP target such as pearcmd.php, and PHP settings like register_argc_argv that enable the PEAR→RCE chain.
- WordPress backported the fix to all supported branches back to 4.7 and recommends immediate updates while administrators manually scan logs and upload/tmp directories for injected .php files.
- Short-term defenses include blocking double-encoded traversal patterns in the pagename parameter, disabling register_argc_argv where feasible, and auditing hosts for signs of compromise because public scanners and weaponized payloads are already circulating.