WordPress Core Vulnerability Allows Remote Code Execution Under Specific Conditions
WordPress issued an emergency patch for a critical flaw tracked as CVE-2026-87902, affecting versions 4.7.0 through 7.1.1. The vulnerability lets an unauthenticated attacker load arbitrary local PHP files, potentially leading to remote code execution depending on server and theme configurations. The update is strongly recommended for all affected installations.
The vulnerability's conditional exploitation hinges on specific environmental factors. The publicly demonstrated attack required PEAR's pearcmd.php to be present on the server and PHP's register_argc_argv setting enabled, narrowing the pool of immediately exploitable installations. However, the flaw spans a broad version range from 4.7.0 through 7.1.1, making it one of the wider-reaching Core vulnerabilities in recent memory.
The attack vector requires no authentication, administrator interaction, or vulnerable plugin, lowering the barrier for potential exploitation. WordPress's emergency patch, version 7.1.2, was released in September 2026, and the company strongly recommends immediate updates across all affected installations. The underlying issue lies in page-template resolution, where manipulated values can direct get_page_template() to include readable PHP files outside the active theme's directories.
Given WordPress's dominance across the web, this flaw could expose millions of sites to unauthorized file inclusion and potential code execution. Organizations running affected versions without rapid patch management may remain vulnerable longer, while smaller site operators lacking dedicated security staff could face particular risk. The conditional nature of full remote code execution may limit widespread exploitation, but the absence of authentication requirements means any exposed installation could be targeted. Site owners may need to prioritize patching and audit their server configurations to assess actual exposure.