WordPress Patches Critical Core Flaw That Could Allow Unauthenticated Code Execution

WordPress has released an urgent security update for a critical vulnerability that can allow attackers to load PHP files outside a website’s theme directories and, under specific conditions, execute malicious code without logging in.

The fix arrived in WordPress 7.1.2 on September 22, 2026. In its release announcement, the project urged administrators to update immediately and credited security researcher Robert Ressl with privately reporting the issue.

Tracked as CVE-2026-87902, the vulnerability carries a critical CVSS 4.0 score of 9.2. The official security advisory describes an unauthenticated path-traversal weakness in page-template resolution. Exploitation requires neither an existing account nor interaction from a legitimate user, although the most serious outcome depends on the website’s theme layout and hosting environment.

That qualification is central to understanding the threat. The flaw does not establish that every vulnerable WordPress installation can immediately be taken over. It does create a dangerous route through which an anonymous request can reach local PHP code that WordPress should not load as a page template.

The affected functionality determines which template renders a requested page. According to Patchstack’s technical analysis, WordPress constructed a candidate filename using a request-derived page name without applying the traversal validation already used in a neighbouring code path.

The resulting filename has a fixed page- prefix and a .php suffix. Those constraints shape exploitation: the active theme needs a suitable top-level directory beginning with page-, and the destination must be a readable PHP file. Under the necessary conditions, directory traversal allows template selection to escape its intended location.

Patchstack reports that the update adds validation to the affected decoded page-name handling and introduces additional checks on template paths containing traversal components. These changes address the underlying path-handling problem. Checking a server’s configuration can help establish exposure, but it does not substitute for installing the corrected code.

The role of themes is particularly significant because an ordinary, legitimate directory structure can satisfy part of the attack’s requirements. WordPress’s theme development documentation describes how custom page templates control the presentation of individual pages and how developers can organise them in subdirectories.

A folder used to keep templates organised can therefore become relevant to a vulnerability elsewhere in the platform. Its presence does not mean the theme developer introduced the core defect, nor does it independently prove that a complete code-execution chain is available.

The official advisory names the legacy Twenty Twelve and Twenty Fourteen themes and third-party themes including Neve, Hestia and Sydney as examples with the relevant layout. Both active parent and child themes matter. The advisory also identifies environments involving official PHP Docker images and default cPanel configurations running PHP earlier than 8.5 as relevant to the documented execution route.

Moving from local file inclusion to arbitrary code execution requires another component. Loading an existing PHP file executes that file’s logic; it does not automatically give an attacker control over what that logic does.

In his research disclosure, Ressl demonstrated a route involving PEAR components already present in his test environment. PEAR is not a WordPress dependency. The chain required a readable PEAR entry point, an enabled register_argc_argv setting in the web-facing PHP runtime, and a writable destination.

Ressl tested WordPress 7.0.2 in isolated laboratories and published a proof of concept alongside the patch announcement. Execution occurred with the permissions of the PHP/web-server account. The results did not demonstrate root access, a host escape or exploitation of a production website. He also did not measure how widely the complete set of prerequisites exists across live installations.

Those limits do not make the potential impact trivial. Ressl explains that service-account permissions can still allow access to configuration and database credentials, changes to site data, modification of writable application resources, or disruption. For organisations, the practical exposure consequently depends on both the vulnerable application and the privileges granted to the process running it.

PHP configuration deserves particular attention during exposure assessment. The PHP manual explains that register_argc_argv controls whether argument variables are declared and documents the deprecation, in PHP 8.5, of deriving those values from query strings outside the command-line environment.

Administrators should verify the effective configuration used to serve web requests. A command-line PHP check may describe a different runtime configuration. A version number alone should not be treated as evidence that a particular setting is disabled.

Ressl recommends disabling unnecessary argument registration for web requests and removing unused web-readable PEAR entry points as supplementary hardening. These actions can interrupt the demonstrated execution chain, but leave the WordPress file-inclusion defect unresolved.

The update also requires attention from organisations that patched recently. WordPress 7.1.1, released in the previous week’s security update, remains affected by this separate issue. A recent maintenance date is therefore insufficient evidence of remediation.

The official advisory lists fixed versions including 7.1.2, 7.0.6, 6.9.9, 6.8.10, 6.7.9 and 6.6.9, with further backports reaching 4.7.37. Administrators maintaining older branches should consult the complete version list rather than assuming that any later minor release contains the fix.

WordPress says those backports were supplied as a courtesy and emphasises that only the latest version is actively supported. They provide a way to address the immediate vulnerability on older installations while longer-term migration work proceeds.

Sites configured for automatic background updates should begin updating automatically. Other administrators can use the dashboard’s Updates screen or obtain the release directly from WordPress.org. Operationally, organisations should verify completion across their estate, including secondary sites and externally managed installations, rather than relying solely on an update policy being enabled.

Public exploit material increases the importance of prompt remediation, but a laboratory demonstration is different from evidence of attacks. The Hacker News reported no known exploitation as of September 22. That dated assessment should not be treated as a guarantee that scanning or attacks cannot subsequently emerge.

For defenders, the appropriate response combines patching with proportionate review. WordPress’s hardening guidance highlights the value of access and error logs, file-change monitoring, restrictive permissions and dependable backups.

Applied to this incident, those practices support checking suspicious path-handling requests and unexpected PHP-file changes while retaining evidence for investigation. Such checks are defensive recommendations based on the disclosed mechanism, not indicators of a confirmed campaign. Ordinary logs may also lack the request detail needed to reconstruct every attempt.

For businesses using hosting providers or agencies, remediation should have a named owner and a verified outcome. Confirming the installed release, checking essential site functions after the update and documenting unresolved exceptions are more useful than a general assurance that security updates are managed.

The wider lesson is that exposure cannot always be assessed from the content-management system alone. A core software defect, a legitimate theme structure and a server-side utility can combine into a more serious compromise path. Updating WordPress closes the disclosed entry point; reducing unnecessary runtime features and filesystem permissions helps limit the consequences of future flaws.