WordPress has patched a severe security flaw in the core platform—tracked as CVE-2026-87902—that allows attackers to run malicious code on a site without logging in. The issue affects the page template resolution system, which under certain conditions can be forced to include PHP files outside of trusted theme directories. This makes the vulnerability especially dangerous for unpatched sites.
How the Vulnerability Works
The problem revolves around the way WordPress determines which PHP template to use when rendering a page. A security researcher discovered a flaw that, in specific server and theme setups, lets a remote attacker influence that template resolution process. As a result, WordPress may end up including a local PHP file not meant to be accessible via the theme rendering mechanism. If that file exists and is readable from outside the active theme directory, it could be executed—leading to remote code execution (RCE). Crucially, no authentication is needed.
Scope & Risk Factors
Not every WordPress install is vulnerable. Exploitability depends on several preconditions: the active theme must meet certain behavior patterns; the server configuration has to allow access to specific local files; and there must be at least one readable PHP file outside the theme folder that the attacker can reach. Once those align, though, the risk is high because an attacker doesn’t need any login credentials.
If exploited, this vulnerability could lead to many critical consequences: web shells, database credentials leakage, site content tampering, new administrative accounts being created, visitor redirection, or using the compromised site as a launchpad for further attacks. Sites that are exposed or have automatic scanning enabled are especially at risk.
What Admins Must Do Now
WordPress has rolled out version 7.1.2 to fix the flaw. Site owners are strongly urged to upgrade immediately. Updates can be applied via the WordPress dashboard’s update screen, or by installing the latest package from WordPress.org. Sites with automatic background updates enabled should receive the patch without manual action.
The fix has also been backported to older supported branches, including releases going back to version 4.7. Although only the newest version is actively supported, administrators using older versions can still apply the security update.
Post-update, it’s wise to confirm the site is running a patched WordPress core. Checking logs for odd template-path requests, unexpected PHP execution, or unanticipated creation of admin users can help detect possible compromises. Also, review themes or custom code that alter how templates are chosen to ensure they don’t reintroduce exploitable paths.
This vulnerability is grounded in core WordPress functionality—specifically the template resolution system—and threatens sites without requiring valid credentials. Exploitation could lead to full server compromise if conditions are met. That makes it critical for any public-facing WordPress instance to prioritize patching CVE-2026-87902 without delay.
Analytically, this highlights a recurring issue with widely used platforms: when core systems like template resolution aren’t rigorously sandboxed, even minor misconfigurations or legacy themes can open major vulnerabilities. Organizations must move beyond reactive patching—they need to audit theme behavior and server setups proactively. Beyond WordPress 7.1.2, the pressure is on theme developers and hosting providers to close these gaps at the root, not just at the patch level.
