WORDPRESS CRITICAL — UNAUTHENTICATED PAGE

Dark Web Intelligence on X: "🚨 WORDPRESS CRITICAL — UNAUTHENTICATED PAGE-TEMPLATE PATH TRAVERSAL CAN ENABLE RCE

WordPress has issued a critical security release for CVE-2026-87902: an unauthenticated attacker can make page-template resolution include a chosen readable local PHP file outside the active theme directories. When server and theme pre-conditions are met, that can lead to remote code execution.

• Severity: Critical — CVSS 9.2 (CVSS:4.0)

• CVE / GHSA: CVE-2026-87902 / GHSA-7hp8-65ch-5whp

• Affects: WordPress 4.7.0 through 7.1.1 (including last week’s 7.1.1)

• Fix: WordPress 7.1.2 (and backports down to 4.7.37)

• Pre-conditions for RCE: active theme has a top-level folder starting with page- (e.g. page-templates); a useful local .php target is readable (e.g. pearcmd.php when register_argc_argv is On)

• Exploitation in the wild: none reported as of the advisory; not on CISA KEV

• Credits: Robert Ressl (responsible disclosure)

This is the official 7.1.2 security release published September 22, 2026, with matching GHSA-7hp8-65ch-5whp. It is a separate flaw from the September 17 WordPress 7.1.1 Click2Shell fixes — sites that already updated to 7.1.1 still need 7.1.2. WordPress rates it critical and recommends updating immediately; automatic background updates will pull it where enabled.

#DDW #DarkWeb #CyberSecurity #ThreatIntelligence #WordPress #CVE"

🚨 WORDPRESS CRITICAL — UNAUTHENTICATED PAGE-TEMPLATE PATH TRAVERSAL CAN ENABLE RCE

WordPress has issued a critical security release for CVE-2026-87902: an unauthenticated attacker can make page-template resolution include a chosen readable local PHP file outside the active theme directories. When server and theme pre-conditions are met, that can lead to remote code execution.

• Severity: Critical — CVSS 9.2 (CVSS:4.0)

• CVE / GHSA: CVE-2026-87902 / GHSA-7hp8-65ch-5whp

• Affects: WordPress 4.7.0 through 7.1.1 (including last week’s 7.1.1)

• Fix: WordPress 7.1.2 (and backports down to 4.7.37)

• Pre-conditions for RCE: active theme has a top-level folder starting with page- (e.g. page-templates); a useful local .php target is readable (e.g. pearcmd.php when register_argc_argv is On)

• Exploitation in the wild: none reported as of the advisory; not on CISA KEV

• Credits: Robert Ressl (responsible disclosure)

7.1.2 security release published September 22, 2026, with matching GHSA-7hp8-65ch-5whp. It is a separate flaw from the September 17 WordPress 7.1.1 Click2Shell fixes — sites that already updated to 7.1.1 still need 7.1.2. WordPress rates it critical and recommends updating immediately; automatic background updates will pull it where enabled.

🚨 WORDPRESS CRITICAL — UNAUTHENTICATED PAGE-TEMPLATE PATH TRAVERSAL CAN ENABLE RCE

WordPress has issued a critical security release for CVE-2026-87902: an unauthenticated attacker can make page-template resolution include a chosen readable local PHP file outside the active theme directories. When server and theme pre-conditions are met, that can lead to remote code execution.

• Severity: Critical — CVSS 9.2 (CVSS:4.0)

• CVE / GHSA: CVE-2026-87902 / GHSA-7hp8-65ch-5whp

• Affects: WordPress 4.7.0 through 7.1.1 (including last week’s 7.1.1)

• Fix: WordPress 7.1.2 (and backports down to 4.7.37)

• Pre-conditions for RCE: active theme has a top-level folder starting with page- (e.g. page-templates); a useful local .php target is readable (e.g. pearcmd.php when register_argc_argv is On)

• Exploitation in the wild: none reported as of the advisory; not on CISA KEV

• Credits: Robert Ressl (responsible disclosure)

7.1.2 security release published September 22, 2026, with matching GHSA-7hp8-65ch-5whp. It is a separate flaw from the September 17 WordPress 7.1.1 Click2Shell fixes — sites that already updated to 7.1.1 still need 7.1.2. WordPress rates it critical and recommends updating immediately; automatic background updates will pull it where enabled.

CVE-2026-87902: Critical WordPress file inclusion and conditional RCE — Robert Ressl