English
Русский
The WordPress security team has released emergency update 7.1.2 to address CVE-2026-87902, a critical vulnerability rated 9.2 on the CVSS scale. Under certain server and theme configurations, the flaw can allow an unauthenticated attacker to achieve remote code execution on the server.
WordPress Can Be Tricked Into Loading an Arbitrary PHP File
The vulnerability is tied to the handling of the pagename parameter. By sending a specially crafted request, an attacker can potentially make the WordPress core load an arbitrary PHP file located outside the active theme directory.
That alone is a serious problem, but the consequences can become much worse under the right conditions. With certain server and theme configurations, the flaw can be turned into remote code execution (RCE), giving an attacker the ability to run arbitrary commands and potentially take full control of the website.
No authentication is required for the attack. In other words, a request that should merely point WordPress toward a page can, under vulnerable conditions, become a route straight into the server.
The Flaw Dates Back to WordPress 4.7
CVE-2026-87902 affects WordPress installations running versions older than 7.1.2, with the underlying vulnerability present since WordPress 4.7. That puts a wide range of installations at potential risk, including sites that have remained on older release branches for years.
The recommended fix is to upgrade to WordPress 7.1.2. Security patches have also been backported to older branches, with fixes available through version 4.7.37.
The emergency release was published on September 22, 2026. Given the severity of the vulnerability, postponing the update leaves a surprisingly small piece of the URL standing between an ordinary page request and a potentially serious server compromise.