Overview
- WordPress released security update 7.1.2 on Tuesday to fix CVE-2026-87902, an unauthenticated path traversal and local file inclusion bug that affects versions back to 4.7.
- The bug lives in get_page_template(), where a filename built from the pagename parameter skipped validate_file(), allowing attackers to force WordPress to include readable .php files outside theme folders.
- Remote code execution requires a chain of conditions: an active theme with a top-level folder beginning with "page-", a readable PHP file such as PEAR’s pearcmd.php, and PHP configured with register_argc_argv enabled.
- Security firms observed probing within hours of the patch and a surge to active exploitation that writes attacker-controlled PHP files into /tmp and /var/tmp with names like wp-pear-rce-flag.php and poc87902.php.
- Site operators should update immediately to 7.1.2 or the appropriate backport, audit access and web-server logs for double-encoded traversal and the listed payload filenames, and use short-term mitigations such as disabling register_argc_argv or removing PEAR until patches are applied.