WordPress 7.1 introduced a new set of features and improvements, but the 7.1 branch has also faced serious security issues that site owners should not ignore.
The most important issue is CVE-2026-87902, a critical unauthenticated path traversal vulnerability in WordPress Core. The vulnerability can allow an attacker to make WordPress include a readable PHP file from outside the active theme directory. Under specific theme and server conditions, that local file inclusion can lead to remote code execution (RCE).
The issue was fixed in WordPress 7.1.2, released on September 22, 2026. WordPress also backported the security fix to supported security branches as far back as WordPress 4.7.
If your website is still running an affected WordPress version, updating should be treated as a security task rather than an optional maintenance change.
What is the WordPress 7.1 Security Problem?
CVE-2026-87902 affects the way WordPress resolves page templates.
Normally, WordPress determines which template file to use when displaying a page. The vulnerability allows an unauthenticated attacker to manipulate that process so that WordPress can include a chosen readable PHP file outside the active theme directories.
This is known as local file inclusion (LFI) combined with a path traversal issue.
Path traversal occurs when an application allows an attacker-controlled path to move outside an intended directory. In this case, the vulnerable template-resolution process could be manipulated to reach PHP files outside the theme directory.
The vulnerability has a CVSS v4 score of 9.2, classified as critical by the WordPress advisory.
More importantly, exploitation does not require the attacker to log in to WordPress or interact with another user.
That combination makes the issue particularly important for publicly accessible WordPress websites.
More details WordPress 7.1 Update Problems
Is Every WordPress Site Automatically Vulnerable to Remote Code Execution?
Not necessarily.
This distinction is important because the vulnerability itself and the conditions required for remote code execution are not exactly the same thing.
The official WordPress advisory identifies two important conditions:
- The active parent or child theme contains a top-level directory whose name starts with
page-. - The server contains a readable PHP file that can be reached through the vulnerable template-resolution behavior.
The advisory specifically mentions older Twenty Twelve and Twenty Fourteen themes, along with third-party themes including Neve, Hestia, and Sydney, as examples with the relevant directory structure. However, administrators should not assume that a theme is vulnerable simply because its name appears on a list. The actual installed theme files and server environment matter.
This means a site can be running an affected WordPress Core version without necessarily having every condition required for RCE.
But that does not make an unpatched installation safe.
The vulnerable WordPress Core behavior is still present, and the required conditions may exist on your particular server without being obvious from the WordPress dashboard.
Why the distinction matters
Think of the vulnerability as a chain.
Unauthenticated request → path traversal → local PHP file inclusion → possible code execution
The first part does not require an account. The final step depends on additional conditions.
That is why WordPress describes the vulnerability as leading to conditional RCE rather than saying that every vulnerable installation can immediately execute arbitrary code.
Which WordPress Versions Are Affected?
The official advisory lists affected releases from WordPress 4.7.0 through 7.1.1, with the corresponding fixed releases extending across the supported security branches.
Some of the important fixed versions are:
| WordPress Branch | Fixed Version |
|---|---|
| 7.1.x | 7.1.2 |
| 7.0.x | 7.0.6 |
| 6.9.x | 6.9.9 |
| 6.8.x | 6.8.10 |
| 6.7.x | 6.7.9 |
| 6.6.x | 6.6.9 |
| 6.5.x | 6.5.12 |
| 6.4.x | 6.4.12 |
| 6.3.x | 6.3.12 |
| 6.2.x | 6.2.13 |
| 6.1.x | 6.1.14 |
| 6.0.x | 6.0.16 |
| 5.9.x | 5.9.18 |
| 5.8.x | 5.8.17 |
| 5.7.x | 5.7.19 |
| 5.6.x | 5.6.21 |
| 5.5.x | 5.5.22 |
| 5.4.x | 5.4.23 |
| 5.3.x | 5.3.25 |
| 5.2.x | 5.2.28 |
| 5.1.x | 5.1.26 |
| 5.0.x | 5.0.29 |
| 4.9.x | 4.9.33 |
| 4.8.x | 4.8.32 |
| 4.7.x | 4.7.37 |
WordPress states that the fix was backported to all branches eligible to receive security fixes, currently reaching back to 4.7. The project also notes that only the latest WordPress version is actively supported.
If you are using an older branch because of compatibility requirements, install the appropriate security backport first and plan a broader upgrade when possible.
Why WordPress 7.1.2 Matters
WordPress 7.1.2 is a security release, not simply another maintenance update.
WordPress published the release on September 22, 2026, and specifically recommends updating sites immediately. The release addresses the critical vulnerability described above.
The important point is that you do not need to wait for a theme developer, plugin developer, or hosting company to release something before updating WordPress Core.
The Core fix is already available.
If your site is running 7.1.1 or another affected branch, the first step is to move to the fixed release for that branch.
Are Attackers Already Exploiting CVE-2026-87902?
Current reporting indicates that exploitation activity began very quickly after the vulnerability was disclosed.
Patchstack reported probing activity only hours after the WordPress security release was published. Its researchers subsequently reported attempts involving pearcmd.php that could be used to move beyond basic probing toward writing PHP files.
The Canadian Centre for Cyber Security later reported that open-source reporting indicated exploitation in the wild and stated that CISA had added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog on September 25, 2026.
This changes the practical response for administrators.
You should not treat the vulnerability as something that can simply be patched during your next routine maintenance window.
If an affected site remained online and unpatched after the vulnerability became public, reviewing logs and checking for signs of compromise can be worthwhile in addition to applying the update.
What Should You Check After Updating?
Updating WordPress is the most important step, but administrators of sites that were exposed before patching should also consider a basic security review.
1. Confirm the WordPress version
Do not assume that an automatic update completed successfully.
Open your WordPress dashboard and verify the installed Core version.
You should see 7.1.2 if you are on the 7.1 branch, or the appropriate fixed release for your branch.
2. Review recent server and firewall logs
Look for suspicious requests around the period when the vulnerability became public.
Security researchers have described probing involving unusual template-related parameters and traversal patterns. Patchstack has also documented probes attempting to determine whether local file inclusion was possible.
Your hosting provider, CDN, or Web Application Firewall may provide additional request logs.
3. Check for unexpected PHP files
If your site was exposed while running an affected release, look for unexpected PHP files in locations where they should not normally exist.
Pay particular attention to recently modified files and unfamiliar files inside writable directories.
Do not delete suspicious files blindly if you suspect a compromise. Preserve evidence where possible and investigate how the file appeared.
4. Review administrator accounts
Check your WordPress users for unexpected administrator accounts.
Also review recently created application passwords, API credentials, or other authentication mechanisms where relevant to your environment.
An unfamiliar administrator account can be a sign of compromise, although it can also result from legitimate maintenance activity.
5. Check recently modified plugins and themes
Review plugin and theme files for unexpected modifications.
A compromised website may not immediately show obvious visual changes. Attackers can add backdoors that remain dormant or only activate when a specific request reaches the site.
If you find evidence of unauthorized modification, consider professional incident response rather than simply reinstalling WordPress and assuming the problem is solved.
Does a WordPress Firewall Protect Against This Vulnerability?
A Web Application Firewall (WAF) can provide an additional layer of protection, but it should not be treated as a replacement for the Core update.
Wordfence reported that its Premium, Care, and Response customers received firewall protection for CVE-2026-87902 on September 22, 2026. Wordfence Free users are scheduled to receive the same protection on October 22, 2026.
That distinction matters for sites that have not yet been patched.
A firewall can potentially block malicious requests before they reach vulnerable WordPress code. However, the underlying vulnerable code remains installed until WordPress Core is updated.
The practical approach is:
Patch first → verify the patch → keep firewall protection enabled as an additional security layer.
Do not leave an outdated WordPress installation online simply because your security plugin reports that an exploit is being blocked.
What If You Cannot Update WordPress Immediately?
Sometimes a WordPress update cannot be applied immediately because a website has a legacy plugin, custom theme, or other compatibility dependency.
If you are temporarily unable to update, reduce the exposure while preparing the update.
You can:
- Confirm that your WAF or security service has protection for CVE-2026-87902.
- Contact your hosting provider if you need help applying the security release.
- Create a complete backup before making compatibility changes.
- Test the update on a staging environment where possible.
- Review server and firewall logs.
- Plan the Core update as soon as possible.
These steps are temporary risk reduction measures.
They should not become a reason to remain on an affected WordPress version indefinitely.
What WordPress Site Owners Should Do Now
For most administrators, the response is straightforward.
Step 1: Check your version
Go to Dashboard → Updates and check the WordPress Core version.
Step 2: Install the fixed release
If you are running WordPress 7.1.1, update to 7.1.2.
If you are on an older supported security branch, install the corresponding backported security release.
Step 3: Confirm the update
Return to the Updates screen and verify that the new version is actually installed.
Do not rely solely on an email or automatic-update notification.
Step 4: Test the website
Check your:
- Homepage
- Important landing pages
- Contact forms
- Login functionality
- WooCommerce checkout, if applicable
- Admin dashboard
- Theme-specific functionality
- Critical plugins
A security update should normally be straightforward, but every WordPress environment is different.
Step 5: Investigate if the site was previously exposed
If your site was running an affected version after the vulnerability became public, consider reviewing logs and recently modified files.
If you discover suspicious PHP files, unfamiliar administrator accounts, or other evidence of compromise, move beyond a simple update and perform a proper security investigation.
What This WordPress Security Issue Teaches Us
CVE-2026-87902 highlights an important point about WordPress security: Core, plugins, themes, hosting configuration, and server permissions all work together.
A WordPress site is not protected simply because its theme and plugins appear familiar.
The vulnerability requires specific conditions for RCE, but those conditions can depend on the theme’s directory structure and the server’s filesystem and PHP configuration. The official advisory specifically warns that the relevant layout exists in multiple themes, including legacy and third-party examples.
This is why security maintenance should involve more than checking plugin updates.
A good WordPress maintenance process should include:
- Regular Core updates
- Plugin and theme updates
- Reliable backups
- Web application firewall protection
- Strong administrator authentication
- File integrity monitoring where appropriate
- Server and access-log monitoring
- Removal of unused plugins and themes
- Periodic review of administrator accounts
- Staging tests for important production websites
The goal is not to eliminate every possible security risk. It is to reduce the window in which a known vulnerability can be exploited and make unusual activity easier to detect.
Frequently Asked Questions
Is WordPress 7.1.1 safe?
No. WordPress 7.1.1 is within the affected range for CVE-2026-87902. WordPress 7.1.2 contains the security fix.
Do I need to be logged in to exploit CVE-2026-87902?
No. The vulnerability is unauthenticated, meaning an attacker does not need a WordPress account. The advisory also specifies that user interaction is not required.
Does CVE-2026-87902 automatically give attackers remote code execution?
Not on every installation. RCE depends on additional conditions involving the active theme and the availability of a suitable readable PHP file on the server.
Which themes are affected?
The official advisory gives Twenty Twelve, Twenty Fourteen, Neve, Hestia, and Sydney as examples of themes with the relevant page-* directory structure. However, administrators should verify their actual installed theme rather than assume that a theme name alone determines exposure.
Is WordPress 7.1.2 a security update?
Yes. WordPress identifies 7.1.2 as a security release fixing a critical severity vulnerability and recommends updating immediately.
What if I use WordPress 6.x or an older version?
Check the corresponding security branch and install the fixed release. WordPress backported this security fix through the eligible branches down to WordPress 4.7.
Is a WordPress security plugin enough?
No security plugin or firewall should be considered a substitute for patching WordPress Core. Firewall protection can reduce exposure, but the vulnerable Core code should still be updated.
Leave a response