Zerodayhub

TL;DR — CVE-2026-87902 is a path-traversal / local file-inclusion flaw in WordPress core (CWE-98) that an unauthenticated attacker can turn into conditional remote code execution. Rated CVSS 9.2 (Critical) under v4.0, it affects WordPress 4.7.0 through 7.1.1 – roughly a decade of releases – and was fixed on 22 September 2026 in 7.1.2 with backports across every supported branch. The bug lives in the page-template resolver get_page_template(), which builds a page-{pagename}.php path from user input without the validate_file() check its neighbours use. Full RCE needs specific server conditions (a theme directory starting page-, register_argc_argv enabled and a readable helper like pearcmd.php), but exploitation attempts began within about five hours of the patch and a public PoC is already circulating – so on the world’s most widely deployed CMS, this is a patch-today flaw.

What Is the WordPress Core File-Inclusion Flaw (CVE-2026-87902)?

WordPress is the content-management system behind a very large share of the web – and CVE-2026-87902 is a rare flaw in WordPress core itself, not in a third-party plugin or theme. That distinction matters: a core bug is present on effectively every unpatched site, whatever plugins it runs. Security researcher Robert Ressl reported it privately on 20 July 2026, and WordPress shipped fixes on 22 September 2026.

The vulnerability is an unauthenticated path traversal / local file inclusion (CWE-98) in the way core resolves the template for a page request. Under the right server conditions it becomes remote code execution. Because the trigger is a normal front-end request – no login, no plugin, no user interaction – the reachable surface is enormous: WordPress 4.7.0 through 7.1.1, releases stretching back to late 2016. The catch, and the reason the rating is 9.2 rather than a flat 10, is that turning the file read into code execution requires a specific combination of theme layout and PHP configuration. Plenty of real-world sites meet those conditions; many do not.

How the CVE-2026-87902 Exploit Works

In plain terms: when you request a WordPress “page”, core tries to find the right template file for it – something like page-about.php inside the active theme. This flaw lets an attacker smuggle directory-traversal characters into the part of the URL that names the page, so instead of a template inside the theme, WordPress is tricked into loading a PHP file from somewhere else on the server. If that file does something useful when it runs, the attacker gets code execution.

The mechanism, per the WordPress advisory and Patchstack’s analysis: the flaw is in get_page_template() in wp-includes/template.php. The function takes the pagename query variable and builds a candidate filename of the form page-{$pagename}.php. The problem is that this pagename-derived candidate is not passed through validate_file() – the traversal check that protects the adjacent template branches – and an extra urldecode() on the value turns a traversal-shaped slug into a real filesystem path. An unauthenticated attacker can therefore steer template resolution to a chosen, readable .php file outside the active theme. That is the local file inclusion. It becomes conditional RCE when three things line up: the active theme has a top-level directory whose name begins with page- (present in some legacy default and popular third-party themes), PHP’s register_argc_argv is enabled (the default in the official PHP Docker images and on many cPanel/PHP builds below 8.5), and a usable helper file such as PEAR’s pearcmd.php is present and readable – the classic LFI-to-RCE gadget. ZeroDayHub is not publishing a working request; the defensively useful facts are the affected versions, the fixed builds and the hardening below.

# Triage: is this WordPress install actually exposed?
# 1. What core version is running?  (affected: 4.7.0 - 7.1.1)
wp core version                       # via WP-CLI
#   or check the generator meta / readme.html on the site

# 2. Does the ACTIVE theme have a top-level directory starting "page-"?
ls -d wp-content/themes/<active-theme>/page-*  2>/dev/null

# 3. Is register_argc_argv enabled, and is a PEAR helper reachable?
php -i | grep -i register_argc_argv   # On => the RCE precondition is met
find / -name pearcmd.php 2>/dev/null   # A readable pearcmd.php is the classic gadget

# 4. Hunt the access logs for traversal in the pagename parameter:
#    URL-encoded "../" (%2e%2e%2f) or double-encoded variants around ?pagename=
grep -Ei 'pagename=.*(%2e|\.\.)' access.log

Impact Nuance: Critical Reach, Conditional Code Execution

Two things are true at once here, and the honest reading holds both. First, the reach is huge: this is core, unauthenticated, and affects a decade of releases, so the file-read primitive alone – leaking wp-config.php secrets, database credentials or other readable server files – is a serious problem on its own. Second, the full remote-code-execution outcome is gated by the theme-directory, register_argc_argv and helper-file preconditions described above. That gating is exactly why the score is CVSS 9.2 (v4.0) rather than a perfect 10, and why some early write-ups were careful to say “conditional” RCE.

Do not let “conditional” become “comfortable”, though. The conditions are common enough on shared hosting, containerised deployments and default PHP builds that a meaningful slice of the internet’s WordPress estate is directly exploitable, and the rest is still exposed to unauthenticated file disclosure. With a public proof-of-concept already released and probing seen within hours of the patch, the practical takeaway is simple: patch every WordPress install now, and treat any unpatched, internet-facing site that meets the RCE preconditions as a live target.

A path-traversal bug in a plugin is bad; the same bug in WordPress core is on every unpatched site on the internet at once.

Active Exploitation of CVE-2026-87902

WordPress released 7.1.2 and the accompanying branch backports on 22 September 2026, together with the security advisory (GHSA-7hp8-65ch-5whp). Attackers moved almost immediately. Patchstack’s telemetry recorded the first probing requests at roughly 17:44 UTC the same day – under five hours after the fix went out – a textbook example of defenders and adversaries racing off the same patch diff. A public proof-of-concept was released alongside the disclosure, and independent researchers have since published working traversal-to-RCE write-ups, lowering the bar for opportunistic attackers.

By 23 September 2026, reporting described on the order of dozens of exploitation attempts against monitored sites, with attackers attempting to write PHP webshells into /tmp and /var/tmp. Much of the early traffic has been characterised as probing rather than confirmed mass compromise, and as of 24 September 2026 the CVE is not yet listed in CISA’s Known Exploited Vulnerabilities catalog – a status that could change quickly. Given WordPress’s footprint, a public PoC and same-day probing, the safe assumption is that internet-wide scanning for vulnerable pagename handling is already underway.

Remediation & Mitigation: Patching WordPress for CVE-2026-87902

Update WordPress core now. The flaw is fixed in 7.1.2, and WordPress backported the fix across every supported branch so there is a patched build for older sites too:

• Current branch → upgrade to WordPress 7.1.2.
• Older supported branches → the fix is backported to 7.0.6, 6.9.9, 6.8.10 and further releases down the 6.x line (through to the 4.7.x branch). Move to the patched build for whichever branch you run.
• Sites on automatic minor updates may already have received the patch – verify the running version rather than assuming it applied.

If you cannot update immediately, reduce exposure in the meantime:

• Disable PHP’s register_argc_argv (set register_argc_argv = Off in php.ini). This breaks the primary PEAR-based path to code execution, downgrading the flaw toward file disclosure only.
• Remove or restrict LFI gadgets. Delete or make unreadable any stray pearcmd.php and similar helper scripts that are not needed on a web server.
• Virtually patch at the edge. Use a WAF rule (Patchstack, Wordfence and others shipped rules within hours) to block requests carrying directory-traversal sequences in the pagename parameter.
• Review your active theme. A theme with a top-level directory beginning page- is a precondition for RCE – know whether yours qualifies.

If an unpatched site met the RCE preconditions and was internet-facing, assume it may have been touched. After patching: hunt for webshells in /tmp, /var/tmp, the uploads directory and the webroot (unexpected .php files, recently modified timestamps); rotate secrets that were readable on the box (database credentials and WordPress salts in wp-config.php, API keys, any stored tokens); force a password reset for administrators and invalidate active sessions; and review access logs for traversal patterns in pagename and for follow-on requests to any dropped file. Where compromise is confirmed, restore from a known-good backup taken before 22 September 2026 rather than cleaning in place.

Related ZeroDayHub Coverage

CVE-2026-87902 belongs to a familiar family: unauthenticated path-traversal and file-access flaws in widely deployed software, where reading the wrong file is one step from running the wrong code. For a close parallel in another web platform, see our write-up of the GitLab unauthenticated file read (CVE-2026-85706), where a path-traversal bug leaked server files, secrets and tokens without a login. And for how a file-handling flaw turns straight into execution, read our coverage of the ConnectWise ScreenConnect unauthorized file execution (CVE-2026-84869). The recurring lesson: on software that runs everywhere, a “just a file read” bug rarely stays that way.

Sources & Further Reading

• Patchstack – WordPress 7.1.2 security release: unauthenticated LFI to RCE (root cause, versions, preconditions)
• GitHub Security Advisory – GHSA-7hp8-65ch-5whp (WordPress core CVE-2026-87902)
• NVD – CVE-2026-87902 detail (CVSS 9.2 v4.0, CWE-98)
• CVE.org – CVE-2026-87902 record
• The Hacker News – Attackers exploit WordPress CVE-2026-87902 within hours of disclosure
• SOC Prime – CVE-2026-87902: critical WordPress core RCE flaw (timeline, exploitation)

ZeroDayHub reports on vulnerabilities for defensive purposes only. This article summarises the publicly-documented root cause, affected versions and preconditions but deliberately omits a working exploit while patching is in progress.