WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

1. Executive summary

WordPress released version 7.1.2 on 2026-09-23 to fix CVE-2026-87902, an unauthenticated path traversal in get_page_template() that lets an attacker make WordPress include and execute a PHP file from outside the site's active theme directory. Every release from 4.7.0 through 7.1.1 is affected, and the fix is backported to 24 older branches from 7.0.6 down to 4.7.37. NVD scores the flaw 8.1 HIGH (CWE-98); it is not in CISA KEV and EPSS is 0%, so there is no evidence of exploitation in the wild at the time of writing. For EMEA financial services the exposure is any internet-facing WordPress instance in the estate or in a supplier's, and code execution on such a host is a route to data theft or a pivot into adjacent systems. Patch to 7.1.2 or the matching backport now; the source reports no vendor workaround.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

This is a vendor vulnerability disclosure with no confirmed exploitation, no incident, and no affected client named. The DORA incident-management and reporting articles (Art. 17, 18, 19) and NIS2 Art. 23 are triggered by an incident, and none has occurred here. The supply chain articles (NIS2 Art. 21(2)(d), DORA Art. 28, 29, 30) turn on a specific third-party relationship or concentration exposure, and the source does not establish that any client runs this software through a contracted ICT provider rather than self-hosted. If a client does operate WordPress through a managed hosting provider, its own third-party risk process applies, but that is a client-specific fact this item does not supply.

3. Technical analysis & attack chain

The flaw is in get_page_template(), the WordPress function that selects the theme file used to render a page. An attacker can steer that lookup to a readable .php file elsewhere on the server, and WordPress then includes the file, at which point PHP executes its contents. The attacker needs no account on the site and no action from anyone who has one.

Confirmed steps, as reported:

1. The attacker identifies a WordPress site running a version between 4.7.0 and 7.1.1. No authentication is required at any stage.
2. The attacker sends a request that reaches the page template resolution path and manipulates the input to get_page_template() so the function resolves a path outside the active theme directory. This is the traversal step: the request walks out of the directory the code expected to stay in.
3. WordPress includes the file the attacker pointed at. The source describes this as a readable .php file already present elsewhere on the server, which places the flaw in the local file inclusion variant of CWE-98 rather than a remote fetch of attacker-hosted code.
4. PHP executes the contents of the included file. Where the server configuration and the active theme meet conditions the source does not specify, this results in code execution on the server.

What the source does not give, and what a defender therefore cannot rely on from this advisory alone: the exact request parameter or endpoint, the traversal payload, the specific server and theme conditions required to reach code execution, whether an attacker must first place a file on the server through some other means, and whether the traversal is reachable on every configuration in the affected range. The source also gives no proof of concept and no exploitation telemetry.

Two classification discrepancies are worth recording. NVD records CWE-98 (improper control of filename for include/require in PHP), while the source describes the flaw as a path traversal; both describe the same defect, since the traversal is the mechanism by which the include target is controlled. On severity, the verified value is CVSS 8.1 HIGH, while the source quotes WordPress's own score of 9.2 on CVSS v4.0. These are different scoring versions and the verified 8.1 HIGH is used throughout this advisory.

Confidence: the technical detail above rests on a single source, Help Net Security's write-up of the WordPress release, which itself restates the project's own advisory. We have not independently reproduced the flaw. Treat the mechanism as reported rather than confirmed by Adverse Trace.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory every WordPress instance in the estate, including staging, marketing microsites, and supplier-hosted sites, and record the running version. The version is in wp-includes/version.php ($wp_version) and in the Dashboard footer.
• Update any instance on 4.7.0 through 7.1.1 to 7.1.2. Where a site is pinned to an older branch, apply the backport for that branch: the fix ships in 7.1.2 and in 24 older branches from 7.0.6 down to 4.7.37.
• Sites that accept automatic background updates will begin the update themselves. Confirm the update completed rather than assuming it did, and check that no site has automatic updates disabled by a host or a plugin.
• Verify after patching that the running version reports 7.1.2 or the backported build for the branch in use.

P2 (within 72 hours)

• For instances that cannot be patched inside 24 hours, apply compensating controls. The source gives no vendor workaround, so these are not vendor-provided: reject requests containing directory traversal sequences (../, ..%2f, and encoded variants) to the affected sites at the WAF or reverse proxy, and restrict the web user's read access to PHP files outside the WordPress root.
• Review web server access logs and PHP error logs for requests that resolved a template to a path outside wp-content/themes/, and for include or open_basedir warnings naming files outside the WordPress root.
• Check writable directories for unexpected .php files, since the flaw requires a readable PHP file outside the theme directory to be present on the server.

P3 (within 7 days)

• Run a post-patch integrity check: compare core files against a clean WordPress 7.1.2 tree and look for modified or added PHP files, webshells, and unauthorised administrator accounts or scheduled events.
• Add WordPress version to the asset inventory with a patch SLA, and confirm which sites are on branches that still receive security fixes. WordPress notes that only the most recent version is actively supported, so a backport buys time rather than a supported end state.

5. Indicators of compromise

No indicators of compromise available in the source material.

The source describes observable behaviour but no atomic indicators. The behaviours below are derived from the described mechanism and are not vendor-published detection signatures; confidence is low and they should be tuned against each environment before use.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The source provides no file hashes, filenames, command-line flags, registry keys, mutexes, or network artefacts. The only named string, get_page_template(), is a legitimate WordPress core function and a rule matching it would detect WordPress itself rather than the exploitation attempt.

CVE assessment

1 referenced CVE

7. Sources

• Help Net Security, "WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)", https://www.helpnetsecurity.com/2026/09/23/cve-2026-87902-wordpress-7-1-2-security-release/, 2026-09-23. Single source for all technical detail in this advisory.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-87902 as 8.1 HIGH per NVD, not listed in CISA KEV, with EPSS at 0%: a serious flaw in a very widely deployed component, but with no evidence of exploitation and no public proof of concept in the material we hold. Client impact is concentrated in internet-facing WordPress instances, where successful exploitation yields code execution on the web host and a route to the data and internal network that host can reach. The technical detail here rests on a single source, Help Net Security's write-up of the WordPress release, and we have not independently reproduced the flaw or seen exploitation telemetry; treat the mechanism as reported rather than confirmed by us. We will monitor for a public exploit, for KEV or EPSS movement, and for WordPress backport advisories, and will reissue this note if exploitation is observed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.