Critical Unauthenticated Path Traversal Vulnerability in WordPress

• •CVE-2026-87902 allows unauthenticated local file inclusion in WordPress.
• •The flaw affects all versions from 4.7.0 to 7.1.1, with a CVSS score of 9.2.
• •WordPress 7.1.2 is the patched version; immediate updates are recommended.

On September 22, 2026, WordPress released version 7.1.2 to address a critical unauthenticated path traversal vulnerability tracked as CVE-2026-87902. This flaw allows unauthenticated attackers to include local PHP files from outside the active theme directories, potentially leading to remote code execution under specific conditions. The vulnerability affects all WordPress versions from 4.7.0 to 7.1.1, with a CVSS score of 9.2, indicating a critical severity. The issue arises from the `get_page_template()` function, which fails to validate the `pagename` parameter properly, allowing for directory traversal. Site owners are urged to update immediately as the flaw poses a significant risk of site compromise. No active exploitation has been reported as of the advisory, but the potential for exploitation exists. The vulnerability was discovered by Robert Ressl, who reported it through the HackerOne platform.