WordPress 7.1.2 Patches Critical Unauthenticated Path Traversal Flaw
Summary
WordPress 7.1.2 fixes CVE-2026-87902, a critical path traversal flaw affecting versions 4.7.0–7.1.1 that could enable unauthenticated attackers to run code under certain server and theme conditions.
Key points
- CVE-2026-87902 affects WordPress versions 4.7.0 through 7.1.1 and is in the get_page_template() function.
- An unauthenticated attacker could exploit path traversal to make WordPress load a PHP file outside the active theme directory.
- Under certain server and theme conditions, loading the file could lead to remote code execution.
- WordPress rated the flaw 9.2 out of 10 under CVSS version 4.
- The fix is available in WordPress 7.1.2 and 24 older branches, from 7.0.6 down to 4.7.37.
- WordPress recommends updating immediately; sites with automatic background updates will begin updating automatically.
Article Details
- Vulnerability Types
- Path traversal leading to arbitrary PHP file inclusion and potential remote code execution
- Severity
- Critical; CVSS 9.2/10 (CVSS v4)
- Affected Versions
- WordPress 4.7.0 through 7.1.1
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available