CVE-2026-87902: WordPress RCE Flaw Already Exploited

WordPress 7.1.2 shipped on September 22 with a single fix: CVE-2026-87902, a CVSS 9.2 path traversal flaw that lets unauthenticated attackers load arbitrary PHP files outside the active theme. The patch went live at midnight UTC. Less than 18 hours later, attackers were already fingerprinting vulnerable sites. If your WordPress install isn’t on 7.1.2 — or a backported equivalent — you’re in the window.

What’s Broken

The vulnerability lives in wp-includes/template.php, inside get_page_template(). When WordPress resolves which template to render for a page, it builds a candidate filename from the pagename query parameter: page-{pagename}.php. A neighboring code path applies validate_file() to block traversal — the pagename branch doesn’t. It was an omission that sat unnoticed across a decade of releases.

The bypass is precise: WordPress’s URL sanitizer strips literal dots but preserves percent-encoded ones. Send %252e%252e (double-encoded dots) in the pagename, and it survives sanitization intact. Then get_page_template() calls urldecode(), which finishes the decode to ../. The attacker has escaped the theme directory and can point the include at any readable .php file on the server.

That’s Local File Inclusion — unconditional on any unpatched WordPress running 4.7.0 through 7.1.1, which covers every release since 2016.

Who Is Actually at Risk

Remote code execution requires two conditions stacking on top of LFI. Whether those conditions exist depends entirely on your stack:

• Docker deployments: The official PHP Docker image ships with register_argc_argv=On by default. If you’re running WordPress in a container and haven’t hardened that setting, you’re in the highest-risk category.
• cPanel hosting on PHP < 8.5: Same situation. register_argc_argv is enabled, and cPanel environments frequently have PEAR installed — the library that completes the RCE path.
• Legacy default themes: Twenty Twelve and Twenty Fourteen — themes that shipped with WordPress for years — have top-level page-* directories. That’s the second structural condition for the RCE chain.

PHP 8.5 flipped register_argc_argv to Off by default, reducing RCE risk for newer setups. But LFI remains active regardless — and 88% of WordPress sites are running something older than the latest release.

The RCE Chain

With both conditions in place, the escalation path runs through PEAR’s pearcmd.php. When register_argc_argv is on, pearcmd.php reads commands from $_SERVER['argv'] — controllable via query string. From there, arbitrary file creation is possible. From there, shell access.

Patchstack’s telemetry is clear on where attackers currently stand: reconnaissance. The probes observed since September 22 are fingerprinting — building a list of sites with the vulnerable theme-directory condition. Full RCE delivery hasn’t appeared in their data yet. That window is closing.

Three Checks, Right Now

If you can’t patch immediately, run these checks to assess your exposure:

1. Theme directory: Does your active theme have a top-level folder starting with page-? If yes, LFI is exploitable and the RCE precondition is met.
2. PHP configuration: Run php -i | grep register_argc_argv. Output showing On puts you in the RCE-risk category. Disable it in php.ini as a stopgap.
3. PEAR presence: Is pearcmd.php accessible on your server? On managed hosts and Docker containers, PEAR is often installed by default. Its presence completes the exploit chain.

For WAF protection, block percent-encoded traversal sequences in the pagename parameter. The double-encoding pattern is a reliable detection signal.

Update Paths

WordPress backported this fix unusually deep — down to 4.7.37. The signal: the security team recognizes the breadth of exposure across a decade of installs. Find your branch below:

Current Version	Update To
7.1.x	7.1.2
7.0.x	7.0.6
6.9.x	6.9.9
6.8.x	6.8.10
4.7.x and older	Backported patch available

Sites with automatic background updates enabled are already patched. For everyone else: Dashboard → Updates → Update Now. There is no workaround that replaces the patch.

The Broader Problem

The 5-hour window between patch release and active probing isn’t a WordPress-specific problem — it’s the current tempo of adversarial response. With 88% of WordPress sites behind the latest release and WordPress powering roughly 43% of the web, unpatched exposure scales fast.

Robert Ressl, the researcher who discovered and responsibly disclosed CVE-2026-87902, published a detailed security advisory alongside the fix. The exploit mechanics are fully public. Reconnaissance is already underway. The question for any unpatched site is whether fingerprinting turns into delivery before the update lands.