WordPress core flaw lets attackers run code on some sites without logging in (CVE-2026-87902)

25 October 2026Critical 9.2Being exploited

WordPress · WordPress core · CVE-2026-87902

WordPress core flaw lets attackers run code on some sites without logging in

A path traversal bug in how WordPress picks a page template lets an unauthenticated visitor make the site load a PHP file from outside the theme folder. On servers where PHP's register_argc_argv setting is on, and with themes that have a top-level folder whose name starts with "page-" (Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney are named examples), this becomes remote code execution. Patchstack saw attacks begin within hours of the fix on 22 September and grow tenfold the next day.

Affected: WordPress 4.7.0 to 7.1.1 on every branch. Default cPanel PHP setups (before PHP 8.5) and the official Docker php image have register_argc_argv on.
What to do: Update to WordPress 7.1.2 or later (7.1.3, released 6 October, adds seven further security fixes). Fixed releases for older branches include 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12 and back to 4.7.37. If you cannot update at once, turn off register_argc_argv and block traversal sequences in the pagename parameter at your firewall. Check /tmp and /var/tmp for unexpected .php files; if you find any, treat the site as compromised.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Exploited within hours of the patch; on CISA's KEV list; affects the platform most of our clients' sites run on.

WordPress core flaw lets attackers run code on some sites without logging in

Affected

WordPress 4.7.0 to 7.1.1 on every branch. Default cPanel PHP setups (before PHP 8.5) and the official Docker php image have register_argc_argv on.

What to do

Update to WordPress 7.1.2 or later (7.1.3, released 6 October, adds seven further security fixes). Fixed releases for older branches include 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, 6.5.12 and back to 4.7.37. If you cannot update at once, turn off register_argc_argv and block traversal sequences in the pagename parameter at your firewall. Check /tmp and /var/tmp for unexpected .php files; if you find any, treat the site as compromised.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Exploited within hours of the patch; on CISA's KEV list; affects the platform most of our clients' sites run on.