WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

WordPress released version 7.1.2 to fix a critical flaw that lets an unauthenticated attacker make the software load a PHP file of the attacker’s choosing from outside the site’s active theme folders. On sites where the server and the active theme meet certain conditions, the attacker can go on to run code on the server.

The project tracks the flaw as CVE-2026-87902 and lists every release from 4.7.0 through 7.1.1 as affected. The attacker needs no account on the site and no action from anyone who has one.

Because this is a security release, it is recommended that you update your sites immediately.

The bug sits in get_page_template() , the function WordPress uses to pick the theme file that renders a page. An attacker can steer that lookup to a readable .php file elsewhere on the server. This is a path traversal bug, meaning the request walks out of the directory the code expected to stay in. WordPress then includes the file, and PHP runs the code inside it.

WordPress rated the flaw 9.2 out of 10 on version 4 of CVSS, the common scale for vulnerability severity. The score assumes an attacker working over the network, with low complexity, no privileges and no user interaction.

The fix ships in 7.1.2 and in 24 older branches, from 7.0.6 down to 4.7.37. Sites that accept automatic background updates will start the update on their own, and others can update from the Updates screen in the Dashboard.

“As a courtesy, the security fix was backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported,” WordPress noted .

Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes

Researchers uncover malware that uses AI to choose its move

Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page

Download: The High-Performance Team Playbook

Simplify security management with CIS SecureSuite Platform

Download: The IT and security field guide to AI adoption

Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes

Prismor: Open-source runtime control plane for AI agents

Product showcase: Scamwise checks the red flags before you take the bait

Researchers uncover malware that uses AI to choose its move

Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page