Overview
- WordPress released version 7.1.2 on Tuesday, Sept. 22 and backported fixes to supported branches down to 4.7.37 to address CVE-2026-87902, a vulnerability rated 9.2 that site owners are told to update for immediately.
- The bug lived in get_page_template(), where WordPress built a filename from the pagename URL value as page-{value}.php without running validate_file(), which allowed ../ path traversal out of theme folders.
- Loading a local .php file does not always give an attacker arbitrary control; practical remote code execution requires specific server conditions such as a readable PEAR pearcmd.php and PHP running with register_argc_argv enabled.
- The patch reinstates the missing validate_file() check and adds a global _wp_is_template_path_allowed() check to the template resolution flow, and sites with automatic background updates will receive the fix without manual intervention.
- Site operators should update now, check active themes for top-level folders starting with "page-", audit for PEAR components and the register_argc_argv setting as temporary controls, and note that researcher Robert Ressl privately disclosed the flaw and published a proof‑of‑concept when the patch shipped while no in‑the‑wild exploits were reported at release.