No Account Needed: Critical WordPress Flaw (CVE-2026-87902) Lets Attackers Run Code on Some Servers — Patch Now
Summary
WordPress has released a security fix for CVE-2026-87902, an unauthenticated path traversal in page-template resolution. Under documented theme and server conditions, the inclusion can lead to remote code execution. The fix is available in WordPress 7.1.2, with backports across supported branches back to 4.7. Matching patched releases should be applied as soon as possible.
Vulnerability Details
| CVE ID | CVSS Score | EPSS Score | Type |
|---|---|---|---|
| CVE-2026-87902 | 9.2 (Critical) | 0.68% | CWE-98: Improper Control of Filename for Include Statement |
Technical Information
CVE-2026-87902 — Unauthenticated Path Traversal in Page-Template Resolution
An unauthenticated attacker can influence page-template resolution so that WordPress includes a chosen readable local PHP file from outside the active theme directories. No account or user interaction is required.
Remote code execution is conditional. The active child or parent theme must contain a top-level directory whose name starts with page- (for example page-templates). That layout appears in some legacy default themes and certain third-party themes. A suitable local .php target must also exist and be readable by the web-server account; when PHP runs with register_argc_argv enabled, known PEAR entry points can complete the path to code execution on common hosting stacks.
Proof of Concept Analysis
A public proof-of-concept is available. At a high level, the flow is:
1. Public query input
Request parameters used in template selection are accepted without authentication.
2. Path material reaches template resolution
Crafted values are processed into template candidates that are not fully constrained to the theme directory tree.
3. Local file inclusion
A readable local PHP file outside the active theme directories can be included during page rendering.
4. Conditional code execution
When theme and server preconditions from the advisory are met, inclusion can lead to code execution under the web-server account.
Exploitation Flow (High-Level)
Input
Construction
Inclusion
Code Execution
Authentication is not required. Code execution depends on theme and server preconditions documented in the advisory.
Impact
-
Local file inclusionAn unauthenticated attacker can cause page-template resolution to include a readable local PHP file outside the active theme directories.
-
Conditional remote code executionWhen theme and server preconditions are met, inclusion can lead to code execution with the privileges of the web-server account, which may allow access to configuration, site data, or writable application resources.
Affected and Fixed Versions
Affected versions span WordPress 4.7.0 through 7.1.1. Fixed releases include:
- 7.1.x → 7.1.2
- 7.0.x → 7.0.6
- 6.9.x → 6.9.9
- 6.8.x → 6.8.10
- 6.7.x → 6.7.9
- 6.6.x → 6.6.9
The fix is backported to older eligible branches through 4.7.37. The full branch list is in the GitHub security advisory and WordPress 7.1.2 release notes. Only the most recent WordPress version is actively supported.
MITRE ATT&CK Mapping
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1083 | File and Directory Discovery | Discovery |
Mitigation and Recommendations
Updating to a patched release is the fix. WordPress does not offer a separate workaround.
- Apply the fixed release for the branch in use. Sites with automatic background updates will start the process automatically; others can update from the dashboard under Updates or download from WordPress.org.
- Where an immediate update is not possible, reducing exposure includes disabling
register_argc_argvfor web requests when it is not required, and removing unused web-readable PEAR entry points. Neither repairs the underlying flaw. - Review active child and parent themes for top-level directories whose names start with
page-. - Limit the PHP process account’s filesystem write access where practical.
Action required: Apply the patched WordPress release as soon as possible. As of the advisory publication, there were no reports of in-the-wild use and no CISA KEV entry. A public proof-of-concept increases the likelihood of scanning against unpatched sites.
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated solution that helps you quickly remediate risks, including critical third-party application updates. It supports Windows, Linux, macOS, and 550+ third-party applications.
You can stage patches in a safe testing environment before production deployment and roll back if needed.
Experience the fastest and most accurate patching software here.
