CVE-2026-87902 — a vulnerability WordPress has rated critical with a CVSS score of 9.2 — lets an unauthenticated attacker make a site load a PHP file from outside its theme folders, and on "some servers" can lead to execution of attacker-controlled code.
What the vulnerability does and how it is reached
WordPress says the flaw is in how it chooses the template file for a page. One of the filenames WordPress builds comes from part of the web address; on affected releases WordPress failed to run that value through the same check for "../" traversal steps used by the surrounding code. Because the filename is constructed as page-{{value}}.php, an attacker needs no account and no action from a logged-in user to reach the vulnerable code path.
Which versions are affected and where the patch landed
Every WordPress release from 4.7.0 through 7.1.1 is affected. The fix shipped on September 22 in WordPress 7.1.2 and was backported to every older branch the project still supports, down to 4.7.37; WordPress says the full list is in the release notes. WordPress rates the flaw critical, assigns CVE-2026-87902 and a CVSS score of 9.2, and tells site owners to update now.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadHow to update and the absence of workarounds
Sites with automatic background updates enabled will receive the update automatically. Other site administrators can update from the dashboard under Updates or download the release from WordPress.org. WordPress does not offer a separate workaround; updating to the patched release is the fix.
Why only "some servers" permit code execution
Loading a local PHP file makes the server run whatever that file already does. Turning that into execution of attacker-supplied code requires a second condition: the server must already host a PHP file that performs something useful when loaded. WordPress highlights that dependence in explaining why the flaw does not mean full code execution on every affected site.
Two practical checks, according to security vendor Patchstack, show how exposed a site might be: whether the active theme has a top-level folder whose name begins with "page-", and whether PHP is running with a setting called register_argc_argv turned on. The attack also needs the target file to end in .php; some themes, including older default WordPress themes, ship a folder that fits the "page-" pattern.
Patchstack notes that neither of those checks is a fix, only indicators of proximity to the worst case. The vendor added that register_argc_argv is off by default on PHP 8.5 and on by default on older PHP versions.
Patchstack, the reporter, and current exploitation status
WordPress credited Robert Ressl with finding and reporting the flaw. As of September 22 there were no reports of the flaw being used in attacks, no public proof-of-concept exploit, and no entry for CVE-2026-87902 in the U.S. CISA Known Exploited Vulnerabilities catalog. The Hacker News has contacted WordPress and Ressl for comment.
What this means for site owners, security teams, and CISA
- Site owners and operators: If your site runs any WordPress release from 4.7.0 through 7.1.1 — including sites updated to 7.1.1 from the September 17 security release — update now to the patched branch appropriate for your install; WordPress provides the update via background updates, the dashboard, or downloads from WordPress.org.
- Security teams and vendors: Patchstack’s checks (active theme folder names and register_argc_argv) provide short diagnostic signals of exposure but are not mitigations; prioritize patching and inventory themes that may include top-level "page-" folders or PHP files that perform actions when loaded.
- CISA and risk managers: As of September 22 there is no KEV entry and no public exploitation, making monitoring for proof-of-concept releases and in-the-wild reports the immediate next observable signals.
WordPress has issued a high-severity, broadly backported fix; the practical exposure on any given site depends on theme layout and server PHP configuration. Administrators should treat this as a timely update rather than a hypothetical: a site patched within the past week to 7.1.1 remains affected, and the only remedy WordPress provides is installation of the corrected release.
