WordPress Patches Critical Code Execution Flaw in Core Software

WordPress has released a critical security patch to address a flaw that allows unauthenticated attackers to load PHP files from outside designated theme folders. The issue, assigned CVE-2026-87902, carries a CVSS score of 9.2 and affects every version from 4.7.0 through 7.1.1, including the latest release from last week.

The vulnerability does not grant code execution on every server. Exploitation requires specific conditions, such as a theme folder starting with "page-" and a server configuration that allows certain PHP behaviors. However, when these conditions align, an attacker can run arbitrary code without needing an account or user interaction.

Specific conditions limit immediate risk

The core issue lies in how WordPress constructs template file names from web addresses. It failed to filter specific directory traversal characters that other parts of the code already checked. This means the attack is not universal; it depends on the active theme and server settings. Security firm Patchstack notes that checking for these two specific factors helps owners gauge their exposure level.

Update paths vary by version

Site owners must update to the specific fixed version for their branch. For example, users on 7.1.x should move to 7.1.2, while those on 6.8.x should update to 6.8.10. WordPress backported the fix to all supported branches, including older versions like 4.7.37. There is no manual workaround; applying the update is the only solution.

No active exploitation reported yet

As of September 22, there are no reports of this flaw being used in the wild. It is not listed in the U.S. CISA catalog of known exploited vulnerabilities, and no public proof-of-concept exists. However, because the flaw is critical and affects a wide range of versions, The Hacker News advises immediate action for all site administrators to prevent potential future attacks.