No Account Needed: Critical WordPress Flaw (CVE-2026-87902) Lets Attackers Run Code on Some Servers — Patch Now
WordPress has fixed CVE-2026-87902, an unauthenticated path traversal in page-template resolution that can lead to remote code execution when theme and server conditions align. The issue affects WordPress from 4.7.0 through 7.1.1 and is patched in 7.1.2, with backports across older supported branches. This article covers how the flaw works, affected and fixed versions, impact, and recommended remediation.
Summary
WordPress has released a security fix for CVE-2026-87902, an unauthenticated path traversal in page-template resolution. Under documented theme and server conditions, the inclusion can lead to remote code execution. The fix is available in WordPress 7.1.2, with backports across supported branches back to 4.7. Matching patched releases should be applied as soon as possible.
Vulnerability Details
| CVE ID | CVSS Score | Type |
|---|---|---|
| CVE-2026-87902 | 9.2 | CWE-98: Improper Control of Filename for Include Statement |
Technical Information
CVE-2026-87902 - Unauthenticated Path Traversal in Page-Template Resolution
An unauthenticated attacker can influence page-template resolution so that WordPress includes a chosen readable local PHP file from outside the active theme directories. No account or user interaction is required.
Remote code execution is conditional. The active child or parent theme must contain a top-level directory whose name starts with page- (for example page-templates). That layout appears in some legacy default themes and certain third-party themes. A suitable local .php target must also exist and be readable by the web-server account; when PHP runs with register_argc_argv enabled, known PEAR entry points can complete the path to code execution on common hosting stacks.
Proof of Concept Analysis
A public proof-of-concept is available. The high-level flow is as follows:
1. Unauthenticated request reaches template selection
WordPress accepts public request parameters used when choosing a page template. The attacker does not need an account, cookie, or privileged role.
2. Crafted input shapes the template candidate
Values tied to page naming are turned into template filename candidates. Because those candidates are not fully constrained to the theme tree, path elements can point outside the intended directories.
3. Loader includes an external local PHP file
The template loader resolves a readable local .php file and includes it during page rendering. At this stage the issue is local file inclusion: the site runs whatever that file already contains.
4. Inclusion becomes code execution on suitable hosts
If the included file can be driven to run attacker-controlled logic, for example through a helper script present on some PHP deployments, execution continues under the web-server account.
Request
Manipulation
Inclusion
Code Execution
Impact
-
Local file inclusionAn unauthenticated attacker can cause page-template resolution to include a readable local PHP file outside the active theme directories.
-
Conditional remote code executionWhen theme and server conditions align, inclusion can lead to code execution with the privileges of the web-server account, which may allow access to configuration, site data, or writable application resources.
Affected and Fixed Versions
As per the WordPress security advisory, the following version ranges are affected and the corresponding patched releases are:
| Affected versions | Patched version |
|---|---|
| 7.1.0 – 7.1.1 | 7.1.2 |
| 7.0.0 – 7.0.5 | 7.0.6 |
| 6.9.0 – 6.9.8 | 6.9.9 |
| 6.8.0 – 6.8.9 | 6.8.10 |
| 6.7.0 – 6.7.8 | 6.7.9 |
| 6.6.0 – 6.6.8 | 6.6.9 |
| 6.5.0 – 6.5.11 | 6.5.12 |
| 6.4.0 – 6.4.11 | 6.4.12 |
| 6.3.0 – 6.3.11 | 6.3.12 |
| 6.2.0 – 6.2.12 | 6.2.13 |
| 6.1.0 – 6.1.13 | 6.1.14 |
| 6.0.0 – 6.0.15 | 6.0.16 |
| 5.9.0 – 5.9.17 | 5.9.18 |
| 5.8.0 – 5.8.16 | 5.8.17 |
| 5.7.0 – 5.7.18 | 5.7.19 |
| 5.6.0 – 5.6.20 | 5.6.21 |
| 5.5.0 – 5.5.21 | 5.5.22 |
| 5.4.0 – 5.4.22 | 5.4.23 |
| 5.3.0 – 5.3.24 | 5.3.25 |
| 5.2.0 – 5.2.27 | 5.2.28 |
| 5.1.0 – 5.1.25 | 5.1.26 |
| 5.0.0 – 5.0.28 | 5.0.29 |
| 4.9.0 – 4.9.32 | 4.9.33 |
| 4.8.0 – 4.8.31 | 4.8.32 |
| 4.7.0 – 4.7.36 | 4.7.37 |
Only the most recent WordPress version is actively supported. Release notes are available on WordPress.org.
MITRE ATT&CK Mapping
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1083 | File and Directory Discovery | Discovery |
Mitigation and Recommendations
Updating to a patched release is the fix. WordPress does not offer a separate workaround.
- Apply the fixed release for the branch in use. Sites with automatic background updates will start the process automatically; others can update from the dashboard under Updates or download from WordPress.org.
- Where an immediate update is not possible, exposure can be reduced by disabling
register_argc_argvfor web requests when it is not required, and by removing unused web-readable PEAR entry points. These steps do not close the vulnerability in WordPress core. - Check whether the active child or parent theme includes a top-level directory whose name starts with
page-, which is part of the practical attack path for this issue.
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated solution that helps you quickly remediate risks, including critical third-party application updates. It supports Windows, Linux, macOS, and 550+ third-party applications.
You can stage patches in a safe testing environment before production deployment and roll back if needed.
Experience the fastest and most accurate patching software here.
