This morning we recommended that WordPress administrators install the update to WordPress 7.1.1 to close a security vulnerability classified as “high” and another classified as “medium”. Those who followed our advice unfortunately have to act again: An update to 7.1.2 is now available, and this time it’s even a “critical” security vulnerability (CVE-2026-87902 with CVSS 9.2).
The reason is the improper control of file names ( Category CWE98 ). As the Swiss Robert Ressi discovered and informed WordPress, attackers can call up not only the intended template for the respective website when calling get_page_template() , but also any additional .php files that exist outside the actually responsible directory on the target system. This can subsequently be exploited for unauthorized code execution on the target system (remote code execution).
One prerequisite is that the name of the top-level directory where the template used is located begins with page- . This is often the case, for example, with WordPress’s own templates in the Twenty Twelve and Twenty Fourteen series, as well as with various popular templates from external providers.In addition, attackers can usually guess the location and file name of an existing .php file.
The update to WordPress 7.1.2 is available . If automatic updates are enabled, the fix will also be applied automatically. The problem also affects older WordPress versions that are no longer officially supported. The patch will be backported for versions from 4.7 onwards. The corresponding work is underway. Even older versions should no longer be used in any case.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
