WordPress released a critical security patch on September 22 that addresses a serious vulnerability affecting millions of websites. The flaw allows attackers without any account credentials to force a site to load PHP files from outside its designated theme folders. Under specific server configurations, this can escalate to remote code execution.

The vulnerability affects every WordPress version from 4.7.0 through 7.1.1. WordPress assigned it CVE-2026-87902 and rated it with a CVSS score of 9.2. The company urged all site owners to update immediately, as the exploit requires no authentication or user interaction.

Which WordPress Versions Need Updates

WordPress released version 7.1.2 to patch the vulnerability in its current branch. However, the flaw also exists in recently updated sites. Version 7.1.1, released just five days earlier on September 17, remains vulnerable to this separate security issue.

The platform backported fixes across all supported branches. Sites running 7.1.x should update to 7.1.2, while 7.0.x sites need 7.0.6. Older branches including 6.9.x, 6.8.x, 6.7.x, and 6.6.x received corresponding patches. WordPress extended fixes back to version 4.7.37 as a courtesy to legacy installations.

Sites with automatic background updates enabled will receive the patch automatically. Other administrators can manually update through their dashboard under Updates or download directly from WordPress.org.

How the Code Execution Vulnerability Works

The vulnerability stems from how WordPress selects template files for page rendering. The system builds file names using portions of the web address without properly sanitizing the input. WordPress failed to run this value through its standard check for directory traversal sequences like ../.

Because the system constructs names in the format page-{value}.php, a successful attack requires specific conditions. The active theme must contain a top-level folder starting with “page-“, and the target file must use the .php extension. Several older default WordPress themes ship with folders matching this pattern, though current default themes do not.

Security researcher Robert Ressl discovered the flaw and reported it privately through WordPress’s HackerOne program in July. He published a detailed analysis after the patch release, including a proof-of-concept demonstration and testing environment.

Server Configuration Impact on Severity

The vulnerability’s impact varies based on server configuration. Loading a local PHP file executes whatever functionality that file contains. Converting this into arbitrary code execution requires an additional element: the server must have a PHP file that performs useful actions when loaded.

This explains WordPress’s reference to “some servers” in its advisory. Not every affected installation faces full code execution risk. The actual threat level depends on the specific server environment and available PHP files.

Security vendor Patchstack identified two key indicators of exposure. First, whether the active theme contains a top-level folder beginning with “page-“. Second, whether PHP runs with the register_argc_argv setting enabled, which certain code execution techniques rely upon.

PHP Configuration Considerations

The register_argc_argv setting behaves differently across PHP versions. PHP 8.5 disables it by default, while older PHP versions enable it automatically. This configuration difference affects the vulnerability’s exploitability but does not eliminate the underlying flaw.

Ressl’s demonstration achieved code execution with web-server account privileges rather than full server control. He tested against WordPress 7.0.2 in isolated laboratory environments, not against patched versions or production websites.

Immediate Actions and Temporary Mitigations

WordPress recommends updating as the only complete fix. The platform does not offer a separate workaround for this vulnerability. Site owners should prioritize applying the security patch across all WordPress installations.

For operators unable to update immediately, Ressl suggests temporary risk reduction measures. Disabling register_argc_argv for web requests and removing unused PEAR components can limit code execution routes. However, these steps do not address the core vulnerability and should not replace proper patching.

As of September 22, no active exploitation had been reported. The vulnerability had not appeared in the U.S. CISA Known Exploited Vulnerabilities catalog. Security researchers had not observed the flaw being used in real-world attacks.

Understanding the Template Selection Flaw

The vulnerability exists in WordPress’s template selection logic. When processing page requests, the system builds potential template file names from URL components. Neighboring code in the same function already employed directory traversal checks, but the vulnerable code path bypassed this protection.

This inconsistency created an exploitable gap. Attackers could craft specially formatted URLs to manipulate the template selection process. The missing validation allowed directory traversal sequences to pass through unchecked.

The fix implements proper input validation across all template file selection paths. WordPress now applies its directory traversal checks consistently throughout the template loading process.

Theme Folder Structure Matters

The specific naming requirement limits exploitation opportunities. Themes must have folders starting with “page-” at the top level. Many custom themes use different folder structures that prevent this attack vector.

Default WordPress themes from earlier releases often included folders matching this pattern. Theme Twenty Seventeen and similar older defaults contain vulnerable folder structures. Recent default themes like Twenty Twenty-Five use different organizational approaches that avoid this issue.

Site owners running custom themes should verify their folder structure. Checking for top-level directories beginning with “page-” provides insight into exposure risk, though updating remains the recommended solution.

Security Release Timeline and Disclosure

Robert Ressl reported the vulnerability through responsible disclosure channels in July 2026. WordPress received the report via its HackerOne bug bounty program and began developing patches for all supported versions.

The fix underwent internal testing across multiple WordPress branches. Developers validated the patch against various theme configurations and server environments before public release. This process ensured the security update would not introduce compatibility issues.

WordPress coordinated the disclosure with Ressl, allowing him to publish his technical analysis after patches became available. This approach gave site owners time to update before exploitation details became public.

The vulnerability received CVE-2026-87902 as its official identifier. This designation allows security teams to track the flaw across vulnerability databases and security scanning tools.

What Site Owners Should Do Now

Update WordPress immediately to the latest version for your branch. This remains the only complete protection against the vulnerability. Automatic updates will deploy patches without manual intervention for sites with that feature enabled.

Verify your active theme’s folder structure if you cannot update right away. Check whether top-level directories beginning with “page-” exist. This assessment helps gauge immediate risk while preparing for updates.

Review your PHP configuration settings. Determining whether register_argc_argv is enabled provides additional context about potential exposure. However, remember that configuration changes do not eliminate the vulnerability.

Monitor your WordPress installations for unauthorized changes. While no active exploitation has been reported, maintaining vigilance helps detect potential compromise attempts. Log analysis and file integrity monitoring provide valuable security insights.

Original Source: thehackernews.com