WordPress Fixes Critical Unauthenticated Local File Inclusion Vulnerability
WordPress has fixed a critical vulnerability in its core software that could allow an unauthenticated attacker to make a website load a PHP file located outside its theme directories.
On certain server configurations, successful exploitation could potentially lead to arbitrary code execution.
The vulnerability was fixed on September 22 with the release of WordPress 7.1.2. Security fixes were also backported to all currently supported WordPress branches, reaching back to version 4.7.
WordPress has urged website administrators to update their installations as soon as possible.
The vulnerability is tracked as CVE-2026-87902 and has been assigned a CVSS score of 9.2, placing it in the critical severity category.
Exploitation does not require an attacker to have an account or convince a logged-in administrator to perform an action.
All WordPress Versions From 4.7.0 Through 7.1.1 Affected
According to WordPress, versions 4.7.0 through 7.1.1 are affected.
This includes WordPress 7.1.1, which was released on September 17 to address separate security issues. As a result, websites that were updated less than a week ago may still be vulnerable to CVE-2026-87902.
The affected vulnerability is separate from the issues addressed in the previous security release.
Administrators should update according to their current WordPress branch:
BranchUpdate to7.1.x7.1.27.0.x7.0.66.9.x6.9.96.8.x6.8.106.7.x6.7.96.6.x6.6.9
WordPress has also backported the security fix to older supported branches as a courtesy, reaching version 4.7.37.
The complete list of patched releases is available in the official WordPress release documentation.
How the Vulnerability Works
The vulnerability is related to the way WordPress determines which template file should be loaded when processing a page request.
On affected versions, part of the template filename is derived from information contained in the web address.
The vulnerable code did not properly apply WordPress's existing protection against directory traversal sequences such as ../.
The resulting filename follows a structure similar to:
page-{value}.php
For exploitation to work, the active theme must contain a top-level directory whose name begins with page-, and the targeted file must have a .php extension.
Some older themes, including certain historical default WordPress themes, contain directory structures that can satisfy these conditions. Current default themes do not necessarily meet them.
Potential Path From File Inclusion to Code Execution
The vulnerability initially allows an attacker to cause WordPress to load an existing PHP file.
Loading a PHP file does not automatically give an attacker the ability to execute arbitrary code. The targeted server must already contain a PHP file that can be abused to execute attacker-controlled instructions.
This additional requirement means that CVE-2026-87902 does not automatically result in arbitrary code execution on every vulnerable WordPress installation.
Security company Patchstack identified two environmental conditions that can help determine how exposed a website may be.
The first is whether the active theme contains a top-level directory beginning with page-.
The second is whether PHP's register_argc_argv setting is enabled. Patchstack notes that a known technique for escalating the vulnerability to code execution relies on this setting.
Neither condition fixes the underlying WordPress vulnerability.
The register_argc_argv setting is disabled by default in PHP 8.5 but is enabled by default in older PHP versions.
Researcher Publishes Proof of Concept
The vulnerability was discovered by security researcher Robert Ressl, who privately reported it through WordPress's HackerOne program in July.
After the security fix was released, Ressl published a technical analysis describing the vulnerability, along with a proof of concept and a self-contained test environment.
His demonstration showed code execution under the privileges of the web server account.
The research was performed against WordPress 7.0.2 in isolated local environments and did not target live production websites.
Recommended Mitigation
WordPress does not provide a separate workaround for CVE-2026-87902. Updating WordPress is the primary remediation.
Website administrators should:
- Update WordPress to the appropriate patched release for their branch.
- Check whether automatic background updates are enabled.
- Review their active theme for directories beginning with
page-. - Review PHP configuration, including the
register_argc_argvsetting. - Monitor server and WordPress logs for suspicious requests if the website was running a vulnerable version.
- Review the system for unexpected PHP files or other signs of unauthorized modification.
For administrators who cannot immediately update, Ressl has suggested disabling register_argc_argv for web requests and removing unused PEAR components. These measures may reduce the potential path to code execution but do not fix the underlying vulnerability.
No Known Exploitation Reported
As of September 22, there were no reports that CVE-2026-87902 had been exploited in real-world attacks.
The vulnerability was also not listed in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog at that time.
Because exploitation does not require authentication, administrators running affected WordPress versions should prioritize applying the appropriate security update.
