WordPress Patches Critical Unauthenticated Flaw That Can Lead to Code Execution on Some Servers

A near-decade-old bug in how WordPress resolves page templates let anyone reach a local PHP file without logging in — and on the wrong server, that's enough to run arbitrary code.

WordPress shipped a security-only release on September 22, 2026, and the single bug it fixes is a serious one. WordPress 7.1.2 closes an unauthenticated local file inclusion flaw in core's page-template resolution logic — a flaw that, under the right server conditions, escalates to remote code execution [1].

No account is needed to trigger it. That alone puts this release near the top of the list for anyone running a self-hosted WordPress site.

What WordPress Fixed

The vulnerability, tracked as CVE-2026-87902 and documented in advisory GHSA-7hp8-65ch-5whp, sits in get_page_template() inside wp-includes/template.php. When WordPress builds a page, this function assembles a list of candidate template filenames and hands them to the loader [2].

One of those candidates gets built directly from the pagename value in the request URL. A neighboring line of code in the same function runs its filename through WordPress's own validate_file() traversal check before accepting it. The pagename-derived candidate never went through that check — the protection existed three lines away from where it was actually needed [3].

Patchstack, which published an independent technical breakdown of the fix, classifies the issue as CWE-98, improper control of filename for an include statement [3]. That's the textbook description of a local file inclusion bug, and it's exactly what's happening here — WordPress ends up loading a PHP file it never intended to load.

Getting From File Inclusion to Code Execution

Loading a local PHP file isn't automatically "run whatever the attacker wants." It runs whatever that file already does. Turning it into attacker-chosen code execution needs a second ingredient: a readable PHP file already sitting on the server that does something useful when it's included that way.

Two conditions decide how exposed a given site actually is, according to Patchstack's analysis. First, the candidate filename is built as page-{value}.php, so the active theme needs a top-level folder whose name starts with page- — something older default WordPress themes and a number of third-party themes ship with. Second, the common path to actual code execution runs through PEAR's pearcmd.php, which only becomes useful when a PHP setting called register_argc_argv is enabled [3].

That setting is off by default on PHP 8.5 but on by default on older PHP versions, including common defaults in cPanel environments and the official PHP Docker images [3]. So the honest way to describe this is a conditional chain — the file inclusion happens on every affected, unpatched install; full code execution depends on what else is sitting on that particular server.

Severity and Scoring

The advisory assigns a CVSS v4 base score of 9.2, rated critical, with a vector of AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N [2]. In plain terms: the attack is reachable over the network, doesn't need much complexity to pull off, needs no account and no user interaction, and can seriously hit confidentiality, integrity, and availability of the vulnerable system itself.

Who's Affected

The advisory lists every WordPress core branch from 4.7.0 up through 7.1.1 as affected — close to a decade of releases [2]. That includes 7.1.1, which itself only shipped days earlier as part of WordPress's September 17 security release for an unrelated flaw. A site that updated less than a week before this release still needs to update again.

WordPress backported fixes as far back as 4.7.37, as a courtesy — though only the current release line is actively supported going forward [1].

Exploitation Status

As of September 22, 2026, there are no reports of this flaw being used in attacks, no public proof-of-concept exploit, and no entry for it in the CISA Known Exploited Vulnerabilities catalog [4]. That status can change quickly once a fix draws attention to what it patches, so it's worth treating as a snapshot rather than a permanent state.

The Fix

WordPress made two changes in 7.1.2. The direct fix applies the same validate_file() check to the previously unchecked candidate filename. The second change is broader: a new containment check requires every resolved template path to actually sit inside an allowed theme directory, regardless of which code path produced it [3]. That second addition suggests the security team treated this as a class of bug worth closing off generally, not just the one reported path.

There's no separate workaround offered — updating is the fix [4]. Sites with automatic background updates enabled should already be on 7.1.2 or the appropriate backported version.

Who Should Act

Every self-hosted WordPress site running a version prior to the fixed release for its branch should update as soon as practical, given the lack of authentication requirement and the network attack vector. Sites without automatic background updates enabled should check the Updates screen in the dashboard directly rather than waiting.

What Isn't Known Yet

There's no public confirmation yet of how many real-world sites carry both preconditions — a theme with a page- prefixed folder and a PHP environment with register_argc_argv enabled — that would turn the file inclusion into full code execution. Patchstack's write-up deliberately doesn't publish a working request chain, so independent researchers haven't had the chance yet to test real-world prevalence at scale.

Security Takeaway

This is a case where the underlying bug — a missing check that already existed three lines away in the same function — is a reminder that consistency matters as much as coverage. WordPress's broader fix, requiring every resolved template path to land inside an allowed directory, closes off the general class of problem rather than just the one reported instance. For site owners, though, the practical story is simpler: there's no workaround, the fix is already out, and updating is the only real answer.

Sources & References

1. WordPress 7.1.2 Release — WordPress.org official announcement
2. GHSA-7hp8-65ch-5whp / CVE-2026-87902 — GitHub Security Advisory
3. WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE — Patchstack
4. WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers — The Hacker News