CVE-2026-87902 is an unauthenticated path traversal vulnerability discovered in WordPress that enables attackers to exploit the get_page_template() function to include arbitrary readable local PHP files outside the active theme directories. For RCE to occur, the active theme must have a top-level directory starting with 'page-', the targeted PHP file must exist and be readable by the web server, and PHP’s register_argc_argv setting must be active. The vulnerability affects WordPress versions prior to 7.1.2, with fixes backported to versions as early as 4.7. Attackers have been observed escalating from reconnaissance to writing malicious PHP payloads to /tmp and /var/tmp directories, which execute shell commands upon access. The vulnerability also affects the official PHP Docker image and default cPanel configurations running PHP versions before 8.5. The WordPress security team assigned a critical severity score of 9.2. Patchstack researchers observed a tenfold increase in exploitation attempts shortly after the patch release.

The vulnerability allows unauthenticated attackers to achieve remote code execution on vulnerable WordPress sites by including and executing arbitrary PHP files. This can lead to full site compromise, unauthorized file writes, and execution of shell commands. The exploitation is active in the wild, with attackers writing malicious PHP files to temporary directories to maintain persistence and control. The flaw also impacts related PHP environments such as the official PHP Docker image and cPanel configurations with PHP versions before 8.5, broadening the potential attack surface.

WordPress has released version 7.1.2 which addresses CVE-2026-87902, with backported fixes to all supported branches down to version 4.7. Site administrators should update to WordPress 7.1.2 or later immediately. Versions prior to 4.7 are not patched and should be upgraded to a supported version. Additionally, reviewing server logs for signs of exploitation and blocking known malicious IP addresses (169.58.48.193, 169.58.48.195, 2001:df1:e8c0::106b) is recommended. No other mitigations are noted in the advisory. The vendor manages remediation for WordPress as a self-hosted platform; administrators must apply updates themselves.