WordPress 7.1.2 fixes a critical flaw that can enable code execution on some servers under specific conditions. According to The Hacker News, WordPress is telling site owners to update affected sites. WordPress patched CVE-2026-87902 on September 22, 2026, with backports for supported branches, while Patchstack and CrowdSec have since reported exploitation attempts against sites running affected releases.
What happened
The Hacker News reported that the flaw allows an attacker with no account to make a WordPress site load a PHP file from outside its theme folders. WordPress rates it critical with a CVSS score of 9.2, and code execution is possible when specific theme and server conditions are present.
Patchstack said the first attempts reached its firewall at 11:49 UTC on 22 September 2026, the same day version 7.1.2 was published. CrowdSec reported on September 28 that its network recorded 322,680 signals matching the exploitation pattern between September 23 and September 27, and its Live Exploit Tracker counted 30,813 unique IP addresses as of September 28.
A later New York State advisory, ITS Advisory 2026-106, states that exploit code for CVE-2026-87902 is available in the wild and that CISA added it to its Known Exploited Vulnerabilities catalog. This differs from the September 22 reporting, when The Hacker News said the flaw had no CISA KEV entry and there were no reports of attacks using it.
Are you affected?
Every WordPress version from 4.7.0 through 7.1.1 is affected, including 7.1.1 from the September 17 security release. This is a separate flaw from the ones fixed in that earlier release, so a site updated last week may still need this patch.
To check the version, look at the WordPress dashboard or the site footer. The New York State advisory lists all WordPress versions before 7.1.2 as affected.
Two conditions determine whether the flaw can progress to code execution, according to Patchstack’s analysis. The active theme must have a top-level folder whose name begins with page-, and PHP must run with the register_argc_argv setting enabled. Older default WordPress themes can include a matching folder, while current default themes do not. The setting is off by default in PHP 8.5 and on by default in older PHP versions.
What to do now
- Apply appropriate updates provided by WordPress or other vendors to vulnerable systems immediately after appropriate testing, as recommended in the New York State advisory.
- Establish and maintain a documented vulnerability management process for enterprise assets, and maintain a risk-based remediation strategy reviewed monthly or more frequently.
- If an immediate update is not possible, Robert Ressl says operators can reduce the route to code execution by disabling
register_argc_argvfor web requests and removing unused PEAR components. Neither step repairs the underlying flaw. - Check web server logs for suspicious requests involving page template paths and unusual PHP files loaded outside the active theme directory. Patchstack says much of the observed traffic uses spoofed browser user agents, so user-agent filtering alone is not reliable.
- Review accounts, file changes and database credentials after updating, especially on sites that were reachable while running an affected version. The New York State advisory recommends applying updates immediately after appropriate testing, running monthly or more frequent patch management and vulnerability remediation, and using authenticated and unauthenticated vulnerability scans on a quarterly or more frequent schedule.
What this means for small-business IT setups
The update needs to cover more than the visible site. A sensible inventory records the WordPress version, PHP version, active theme and hosting model for every site an office maintains.
The New York State advisory recommends a documented vulnerability management process, a risk-based remediation strategy reviewed monthly or more often, and regular automated scanning. For a small IT team, that means scheduling patch checks for WordPress and PHP separately, then confirming that updates completed rather than relying on an email notification.
Wordfence’s October PHP advisory also illustrates why server-level updates need their own checklist. After PHP released emergency fixes on October 21, 2026, Wordfence explained that updating WordPress does not install PHP fixes, and that agencies running their own servers or containers must update the package or image and restart PHP or rebuild the container. That guidance applies to the wider patching routine around this WordPress flaw.
Background
WordPress credited Robert Ressl with discovering the flaw. He disclosed it privately through the HackerOne program in July 2026 and published a detailed write-up with a proof of concept and a self-contained test lab when the fix shipped. His demonstrated attack ran code with the privileges of the web-server account rather than full control of the server, and he tested it against WordPress 7.0.2 in isolated local labs.
The weakness sits in page-template resolution. WordPress builds a candidate file name from part of the web address, and affected versions did not apply the same traversal check used by neighboring code. Because the name takes the form page-{value}.php, a working attack needs a theme with a qualifying folder and a readable PHP file with a matching ending.
CrowdSec said signals peaked at 124,154 on September 27 with 23,321 distinct sources, while the number of distinct sources grew faster than total requests. The network recorded between 1,288 and 1,987 reporting machines each day from September 23 to September 27. WordPress rates the flaw 9.2 Critical in CVSS 4.0, while CISA rates it 8.1 High in CVSS 3.1 because the scoring methods account for the required conditions differently.
FAQ
What is CVE-2026-87902 in WordPress?
CVE-2026-87902 is a critical flaw fixed in WordPress 7.1.2 that lets an unauthenticated attacker make a site load a readable local PHP file outside the active theme directory. WordPress rates it 9.2 on the CVSS scale, and successful exploitation can lead to remote code execution under specific conditions.
Which WordPress versions are affected?
Every version from 4.7.0 through 7.1.1 is affected, and the New York State advisory lists WordPress versions before 7.1.2 as vulnerable. The fix shipped on September 22, 2026, with backports for supported branches down to 4.7.37.
How can I update my WordPress site?
According to The Hacker News, sites with automatic background updates enabled will start the update automatically. WordPress does not offer a separate workaround, so updating is the fix.