---
title: "WordPress 7.1.2 RCE: What CVE-2026-87902 Actually Does"
slug: "wordpress-7-1-2-rce-cve-2026-87902"
description: "WordPress 7.1.2 fixes CVE-2026-87902, a critical bug now on CISA's exploited list. Here's who is exposed, which versions are patched, and how to check."
date: 2026-09-23
modified: 2026-10-02
author: "WP Vanguard Team"
category: "Security"
tags: ["wordpress-core-vulnerability", "cve-2026-87902", "wordpress-7-1-2", "unauthenticated-rce", "local-file-inclusion"]
featured_image: "/images/blog/wordpress-7-1-2-rce-cve-2026-87902.jpg"
---

WordPress 7.1.2 shipped on September 22, 2026, and it fixes exactly one thing: CVE-2026-87902, an unauthenticated path traversal in core's page-template resolution that can end in remote code execution. CVSS 9.2. A public proof-of-concept was already on GitHub the same day, and a nuclei scanning template for it followed within hours.

That combination is what makes this one different from a routine core patch. A CVE with a working exploit chain published before most site owners have even seen the update notice is a CVE that gets mass-scanned fast.

**Update, October 2:** this is no longer a theoretical risk. The Hacker News reported on September 24 that attackers began exploiting it within hours of disclosure, and CISA added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog on September 25, with a September 28 deadline for U.S. federal agencies. The patched releases are 7.1.2, 7.0.6, 6.9.9 and 6.8.10. If you haven't updated, do it now and read the section on [checking for signs of compromise](#how-to-confirm-your-core-version-is-patched) below.

```timeline
{"title": "From release to active exploitation", "data": [
 {"label": "Sep 22", "sub": "Release", "text": "7.1.2 ships; public proof-of-concept appears the same day"},
 {"label": "Sep 24", "sub": "Attacks", "text": "The Hacker News reports exploitation within hours of disclosure"},
 {"label": "Sep 25", "sub": "CISA", "text": "Added to the Known Exploited Vulnerabilities catalog"},
 {"label": "Sep 28", "sub": "Deadline", "text": "U.S. federal agencies must have patched"}
], "highlight": 2}
```

> [!KEY]
> Update to 7.1.2, 7.0.6, 6.9.9 or 6.8.10 now. This bug is being exploited, and patching doesn't undo anything an attacker did before you updated, so check your logs as well.

## What WordPress 7.1.2 Fixed, and When

The [official release announcement](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/) calls it a fix for "a critical severity security vulnerability" and recommends updating immediately. WordPress.org backported the patch to every branch still receiving security fixes, "currently through 4.7." If you're on any maintained line, a point release covers you.

The bug is tracked as CVE-2026-87902 and [GHSA-7hp8-65ch-5whp](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp), reported by researcher Robert Ressl through responsible disclosure. NVD and independent trackers put it at CVSS 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N), which is about as close to "drop everything" as a core score gets without hitting a perfect 10.

The gap between the release and the first attacks was a matter of hours, so the usual habit of updating at the end of the week would already have been too slow here. Sites with automatic background updates likely already have the patch. That's been true for every core security release since WordPress 3.7. If yours is managed manually, or update settings have ever been overridden, don't assume you're covered.

## How the Vulnerability Actually Works

The flaw lives in `get_page_template()`, the function WordPress uses to decide which template file renders a given page. [Patchstack's analysis](https://patchstack.com/articles/wordpress-7-1-2-security-release-unauthenticated-lfi-to-rce/) describes it as an unauthenticated attacker being able to make that resolution include a chosen, readable local `.php` file that lives outside the active theme's directories. That's local file inclusion. Whether it becomes remote code execution depends on what PHP file is reachable and what it does when included, which is why the advisory calls the RCE outcome "conditional" rather than guaranteed.

No login, no form submission with a crafted payload in the usual sense. The vulnerable path is triggered through how WordPress resolves which template to load for a requested page, which is core plumbing every visitor's request touches.

## Who's Actually Exposed

The precondition that matters: exploitation requires the top-level directory for the resolved template to begin with `page-`. [Reporting on the flaw](https://mallory.ai/stories/01a0c9b1-7666-7ecb-af19-bc04f03a6fbf) names Twenty Twelve and Twenty Fourteen as bundled themes that match this pattern, plus an unspecified set of third-party themes. That's not "every WordPress site," but it's also not a rare edge case; both themes shipped with WordPress for years and are still active on a meaningful number of sites, and the same directory-naming pattern shows up in custom and premium themes that were never audited against this specific issue.

Because the precondition is about theme structure rather than a plugin or a setting, there's no simple admin-panel check to confirm exposure. The safest assumption is that any unpatched site running 4.7 through 7.1.1 should be treated as vulnerable until updated, regardless of which theme is active.

## Why the Public PoC Changes the Timeline

Robert Ressl published a [proof-of-concept repository](https://github.com/ressl/cve-2026-87902-poc) with a pinned vulnerable lab environment on the same day as the disclosure. A pull request adding a [nuclei-templates](https://github.com/projectdiscovery/nuclei-templates/pull/17302) detection signature followed almost immediately after.

That's the pattern that turns a disclosed core CVE into a scanned-within-days CVE. Nuclei templates get folded into automated mass-scanning tools quickly, and a public PoC removes the reverse-engineering step attackers would otherwise need. That window has closed. [The Hacker News](https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html) reported exploitation attempts within hours of disclosure, and CISA's KEV listing on September 25 confirms it's being used against real sites. Updating is the fix, but it doesn't undo anything that happened before you patched.

For more on how core-level bugs differ from plugin vulnerabilities in practice, see our breakdown of [the WordPress login XSS fixed in 7.0.3](/blog/wordpress-login-xss-cve-2026-64638): different bug class, same lesson about how fast a core exploit chain gets public once researchers start writing it up.

## How to Confirm Your Core Version Is Patched

Check what's actually installed:

```bash
wp core version
```

Anything below 7.1.2 on the 7.1 branch still has this bug. On older branches the fixed releases are 7.0.6, 6.9.9 and 6.8.10, as listed by The Hacker News, so check your branch against those.

Because attacks started within hours of disclosure, a site that updated late may have been probed first. Look through your access logs from September 22 onward for unusual requests, and check for PHP files that don't belong, using our guide to [signs your WordPress site has been hacked](/blog/signs-wordpress-site-hacked). Then confirm there's no update waiting:

```bash
wp core check-update
```

If you're not on managed hosting with forced updates, verify background updates are actually running rather than just enabled:

```bash
wp cron event list | grep wp_version_check
```

An empty result means your site isn't checking for new core versions on its own, and this update didn't apply itself. If you recently moved to a new major version, our [WordPress 7.0 upgrade security checklist](/blog/wordpress-7-0-upgrade-security-checklist) covers the broader set of post-upgrade checks worth running alongside this one.

For a full pass across core version, plugins, and exposed configuration, [WP Vanguard's free surface scan](/#scanner) checks what's actually running against our vulnerability database in under a minute.

## References

- [WordPress 7.1.2 Release (wordpress.org/news)](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/)
- [WordPress/wordpress-develop Security Advisory GHSA-7hp8-65ch-5whp](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp)
- [Patchstack: WordPress 7.1.2 Security Release, Unauthenticated LFI to RCE](https://patchstack.com/articles/wordpress-7-1-2-security-release-unauthenticated-lfi-to-rce/)
- [CVE-2026-87902 Proof-of-Concept Lab (ressl/cve-2026-87902-poc)](https://github.com/ressl/cve-2026-87902-poc)
- [The Hacker News: Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure](https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html)
- [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)