WordPress 7.1.2 Patches Critical Unauthenticated Path Traversal Flaw

Summary

WordPress 7.1.2 fixes CVE-2026-87902, a critical flaw in get_page_template() that could let an unauthenticated attacker cause WordPress to load a readable PHP file outside the active theme directory. Under certain server and theme conditions, this could enable code execution. WordPress recommends updating immediately.

Key points

• CVE-2026-87902 affects WordPress versions 4.7.0 through 7.1.1 and is rated 9.2 out of 10 on CVSS version 4.
• The flaw is in get_page_template(), which selects the theme file used to render a page.
• An unauthenticated attacker can exploit path traversal to make WordPress load a readable PHP file from elsewhere on the server.
• Code execution is possible under certain server and active-theme conditions.
• The fix is included in WordPress 7.1.2 and backported to 24 older branches, from 7.0.6 down to 4.7.37.
• WordPress recommends immediate updates; sites with automatic background updates will start updating automatically.

Tags

CVE

Vendors

Products