WordPress site owners should update their websites immediately after the WordPress Security Team patched a critical vulnerability that can allow unauthenticated attackers to include local PHP files outside the active theme directory. The vulnerability, tracked as CVE-2026-87902, affects multiple WordPress branches and can lead to remote code execution and complete site compromise under certain conditions.
The issue was patched on September 22 with WordPress 7.1.2 and security updates for older supported branches going back to WordPress 4.7. Wordfence describes the vulnerability as an unauthenticated local file inclusion issue caused by path traversal in WordPress Core.
CVE-2026-87902 affects the way WordPress handles page templates. In vulnerable versions, an attacker can manipulate the pagename parameter in a request to make WordPress look for a PHP file outside the normal theme directories.
The vulnerable behavior is related to the locate_template() function. WordPress did not properly verify that the resulting file remained inside an approved theme directory before loading it. An attacker could therefore use path traversal to point WordPress toward a readable PHP file elsewhere on the server.
The vulnerability does not require an attacker to have a WordPress account or interact with an administrator. This makes it important for websites that are publicly accessible on the internet.
However, the vulnerability does not automatically mean that every unpatched WordPress website can be remotely taken over. Remote code execution requires additional conditions on the website and server.
The active parent or child theme needs to contain a top-level directory beginning with page-. The server must also have a readable PHP file that can provide useful behavior when included. The report specifically mentions themes including Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney as examples with the relevant directory structure.
The report also notes that certain PHP environments can provide a path from local file inclusion to remote code execution. These include the official PHP Docker image and some default cPanel configurations using PHP versions before 8.5, where a PEAR-related file can be accessible.
The vulnerability affects several WordPress branches. WordPress has released security updates for each affected branch.
| Affected version | Fixed version |
|---|---|
| 7.1.0 – 7.1.1 | 7.1.2 |
| 7.0.0 – 7.0.5 | 7.0.6 |
| 6.9.0 – 6.9.8 | 6.9.9 |
| 6.8.0 – 6.8.9 | 6.8.10 |
| 6.7.0 – 6.7.8 | 6.7.9 |
| 6.6.0 – 6.6.8 | 6.6.9 |
| 6.5.0 – 6.5.11 | 6.5.12 |
| 6.4.0 – 6.4.11 | 6.4.12 |
| 6.3.0 – 6.3.11 | 6.3.12 |
| 6.2.0 – 6.2.12 | 6.2.13 |
| 6.1.0 – 6.1.13 | 6.1.14 |
| 6.0.0 – 6.0.15 | 6.0.16 |
| 5.9.0 – 5.9.17 | 5.9.18 |
| 5.8.0 – 5.8.16 | 5.8.17 |
| 5.7.0 – 5.7.18 | 5.7.19 |
| 5.6.0 – 5.6.20 | 5.6.21 |
| 5.5.0 – 5.5.21 | 5.5.22 |
| 5.4.0 – 5.4.22 | 5.4.23 |
| 5.3.0 – 5.3.24 | 5.3.25 |
| 5.2.0 – 5.2.27 | 5.2.28 |
| 5.1.0 – 5.1.25 | 5.1.26 |
| 5.0.0 – 5.0.28 | 5.0.29 |
| 4.9.0 – 4.9.32 | 4.9.33 |
| 4.8.0 – 4.8.31 | 4.8.32 |
| 4.7.0 – 4.7.36 | 4.7.37 |
These version ranges and fixes are listed in the Wordfence report.
WordPress 7.1.2 is the fixed release for users on the 7.1 branch. WordPress has also provided security backports for older branches. Wordfence notes that only the newest release in the 7.1 series is actively maintained, while the older fixes were provided as security backports.
The patch adds two protections to prevent the vulnerable behavior. First, WordPress now checks the decoded page name using validate_file() before adding it to the list of possible templates. This blocks the traversal syntax used through the vulnerable pagename path.
WordPress has also added another check inside locate_template(). Existing template candidates are now checked to make sure their resolved filesystem location remains inside an approved theme or theme-compatibility directory before WordPress loads them.
This second check provides an additional layer of protection for other Core code and filters that may provide template names.
Site owners should updat WordPress on their website and also confirm that the update actually completed rather than assuming that an automatic update was successful.
If you cannot update immediately, check that your firewall has protection against this vulnerability and schedule the Core update as soon as possible. Firewall protection should not be considered a replacement for updating WordPress.
Site administrators should also review server and firewall logs for suspicious requests containing path traversal-like values in the pagename parameter. If there is evidence that an attacker reached the vulnerable template path, the site should be treated as potentially compromised. Wordfence recommends reviewing administrator accounts, recently changed plugins, scheduled tasks and unexpected PHP files as part of the investigation.
If you run a business website on WordPress and are not comfortable handling security updates, malware checks or WordPress maintenance yourself, Techlomedia Internet can help.
Our WordPress services cover website development, maintenance, security hardening, performance optimization and troubleshooting. We can also help review an existing WordPress installation, identify security risks and keep Core, themes and plugins updated.
For businesses that depend on WordPress for their website, keeping the platform updated is an important part of protecting the site and its data. You can contact Techlomedia Internet if you need help managing or securing your WordPress website.
