WordPress 7.1.2: Critical Core Path Traversal Patch, Conditional…

WordPress released version 7.1.2 on September 22, 2026 to address CVE-2026-87902, a critical core vulnerability with a CVSS score of 9.2. The flaw allows unauthenticated attackers to manipulate page template resolution via path traversal. Remote code execution requires two specific conditions: an active theme with a top-level directory prefixed with 'page-' and a PHP environment with 'register_argc_argv=On'.

WordPress released version 7.1.2 on September 22, 2026 to address CVE-2026-87902, a critical core vulnerability with a CVSS score of 9.2. The flaw allows an unauthenticated attacker to divert page template resolution to arbitrary PHP files on the server via path traversal. Remote code execution requires specific conditions: a theme with a top-level directory starting with page- and PHP configured with register_argc_argv=On.

Key Takeaways

The flaw resides in get_page_template(), which constructs the filename page-{value}.php from a URL-derived component without sanitizing ../ sequences.
RCE requires two cumulative conditions: a theme with a page-* directory and PHP with register_argc_argv=On, a default setting on PHP <8.5 and in official Docker images.
Themes cited in the advisory: Twenty Twelve, Twenty Fourteen, Neve, Hestia, Sydney.
No public exploits, confirmed attacks, or CISA KEV entry as of September 22, 2026.

The Mechanism: Traversal in Template Resolution

The vulnerable code sits in get_page_template(), the core function responsible for selecting which PHP file to load. Advisory GHSA-7hp8-65ch-5whp documents that the function interpolates a value derived from the URL path into the pattern page-{value}.php without sanitizing ../ sequences.

The absence of this check allows an attacker to craft requests pointing to PHP files outside the active theme hierarchy. The vulnerability is classified as path traversal with a possible Local File Inclusion consequence.

According to The Hacker News analysis, sanitization against ../ existed elsewhere in the flow but was not extended to the page template resolution path. This inconsistency is the root of the problem.

The Conditions for RCE: Theme and PHP Environment

WordPress communicated that RCE requires specific conditions. The GitHub Security Lab advisory details them precisely.

The first condition concerns the active theme: it must contain a top-level directory whose name starts with page-, such as page-templates. The advisory cites the legacy themes Twenty Twelve and Twenty Fourteen, plus third-party themes Neve, Hestia, and Sydney.

The second condition concerns the PHP environment. Local file inclusion translates to RCE only if the server hosts a "useful" PHP file for the attacker. The documented vector is the PEAR-to-RCE chain via pearcmd.php, which requires register_argc_argv=On.

According to the advisory, this setting is enabled by default on PHP versions prior to 8.5 and in official PHP Docker images. The same configuration is default on cPanel with PHP <8.5.

"An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to RCE." — GitHub Security Lab, advisory GHSA-7hp8-65ch-5whp

Affected Versions and Patch Distribution

Every WordPress version from 4.7.0 through 7.1.1 inclusive is vulnerable. Version 7.1.1, released September 17, 2026, is also affected.

The 7.1.2 release on September 22, 2026 includes the complete fix. WordPress backported the fix to all supported branches, back to version 4.7.37. The absence of documented workarounds makes updating the only available action.

As of September 22, 2026, no public exploits, proof-of-concepts, or reports of active exploitation exist. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.

Immediate Actions

Update immediately to WordPress 7.1.2 or the latest available version in your supported branch; the backport is active from the 4.7 branch onward.
Verify the installed version: every release from 4.7.0 to 7.1.1 is vulnerable.
Check if the active theme has a top-level directory starting with page-; if so, the urgency to update increases.
Verify PHP configuration: register_argc_argv enabled exposes the server to the full RCE chain.
No workarounds or alternative mitigations exist beyond updating.

Context and Risk Assessment

The conditional nature of the RCE has a dual reading. On one hand, it technically limits the attack surface: without both conditions, the vulnerability reduces to path traversal with contained impact. On the other, the configurations documented in the advisory represent real and widespread deployment scenarios.

PHP <8.5 with register_argc_argv=On is a combination present on many production servers. Official PHP Docker images maintain this setting by default, as do cPanel configurations with PHP versions prior to 8.5. Themes with page-* directories include not only the legacy Twenty Twelve and Twenty Fourteen, but also popular commercial themes like Neve, Hestia, and Sydney.

The overlap of these two conditions across the WordPress install base is not quantified in available sources. However, the presence of both conditions on widely used platforms suggests the population at risk of full RCE is not negligible.

The reassuring data point is the absence of known exploits and KEV entry. This risk profile, combined with the availability of the backport, suggests an orderly update process rather than an immediate emergency. The time window between discovery and patch, coupled with the absence of observed exploitation, gives administrators operational breathing room.

The vulnerability was discovered and responsibly disclosed by Robert Ressl. The GitHub Security Lab advisory confirms the technical conditions without undermining the vendor's assessment: the preconditions are real, measurable, and limit exploitability in a documented way.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter