This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] WordPress fixes an actively exploited vulnerability

WordPress version 7.1.2 fixes a critical, actively exploited vulnerability. Only the 7.1 series is actively maintained, but the fix has also been released for all older branches down to 4.7 [1][2].

WordPress - RCE (CVE-2026-87902)
CVSS 9.2 (Critical)

An unauthenticated remote attacker can load a local .php file outside the directories of the active theme and execute arbitrary code, due to insufficient path restriction when looking up the page template. Exploitation is possible only if the active theme contains a directory whose name begins with the prefix page- and a suitable target file exists on the server [1].

The vulnerability is present in product:

  • WordPress; >=7.1.0, <7.1.2; >=7.0.0, <7.0.6; >=6.9.0, <6.9.9; >=6.8.0, <6.8.10; >=6.7.0, <6.7.9; >=6.6.0, <6.6.9; >=6.5.0, <6.5.12; >=6.4.0, <6.4.12; >=6.3.0, <6.3.12; >=6.2.0, <6.2.13; >=6.1.0, <6.1.14; >=6.0.0, <6.0.16; >=5.9.0, <5.9.18; >=5.8.0, <5.8.17; >=5.7.0, <5.7.19; >=5.6.0, <5.6.21; >=5.5.0, <5.5.22; >=5.4.0, <5.4.23; >=5.3.0, <5.3.25; >=5.2.0, <5.2.28; >=5.1.0, <5.1.26; >=5.0.0, <5.0.29; >=4.9.0, <4.9.33; >=4.8.0, <4.8.32; >=4.7.0, <4.7.37

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

  • CVE-2026-87902 at cve.org, NVD
  • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') at cwe.mitre.org

The vulnerability was publicly disclosed 22. 9. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 24. 9. 2026.

CESNET, z.s.p.o. Logo