> PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core

On September 22, 2026, the WordPress Security Team released WordPress 7.1.2, as well as security backports for every branch back to WordPress 4.7 to address a critical unauthenticated path traversal vulnerability. The issue is tracked as CVE-2026-87902 and has a CVSS v4.0 score of 9.2 (Critical). The vulnerability can allow an unauthenticated attacker to make WordPress include a readable PHP file from outside the active theme directory. If the site’s active theme and server environment meet the necessary conditions, the included file can provide a path to remote code execution and complete site compromise. We strongly recommend that all WordPress site owners update immediately and confirm that the update completed successfully. Although exploitation depends on the site’s theme layout and the presence of a suitable local PHP file, the vulnerable behavior is in WordPress Core, requires no account, and can be reached over the internet. Wordfence Premium, Wordfence Care, and Wordfence Response customers received a firewall rule protecting against attacks targeting this vulnerability on September 22, 2026, the day the vulnerability was disclosed. Wordfence Free users will receive the same protection on October 22, 2026, following the standard 30-day delay. Key takeaways: CVE-2026-87902 is a critical unauthenticated path traversal and local PHP file inclusion vulnerability in WordPress Core. Successful exploitation does not require a WordPress account or user interaction. Remote code execution is conditional. The active parent or child theme must contain a suitable top-level page-* directory, and the server must contain a readable PHP file that has useful behavior when included. The official advisory cites legacy Twenty Twelve and Twenty Fourteen, as well as Neve, Hestia, and Sydney, as examples of themes with the relevant directory layout. Administrators should verify their installed theme and filesystem rather than infer exposure from a theme name alone. WordPress 7.1.2 contains the fix. WordPress also released security backports for branches 7.0 through 4.7. Wordfence Premium, Care, and Response customers received firewall protection on September 22, 2026. Wordfence Free users will receive the same protection on October 22, 2026. Site owners should update to the fixed release for their branch immediately. Firewall protection reduces exposure but is not a replacement for updating WordPress Core. Contents Vulnerability Summary from Wordfence Intelligence What Makes This Vulnerability Serious Technical Analysis How the Patch Works Who Is Affected Wordfence Protection What Site Owners Should Do Now Conclusion Vulnerability Summary from Wordfence Intelligence WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal 8.1 CVSS Rating 8.1 (High) CVE-ID CVE-2026-87902 Affected Version(s) Various Patched Versions 4.7.37, 4.8.32, 4.9.33, 5.0.29, 5.1.26, 5.2.28, 5.3.25, 5.4.23, 5.5.22, 5.6.21, 5.7.19, 5.8.17, 5.9.18, 6.0.16, 6.1.14, 6.2.13, 6.3.12, 6.4.12, 6.5.12, 6.6.9, 6.7.9, 6.8.10, 6.9.9, 7.0.6, 7.1.2 Affected Software WordPress [wordpress] Researcher Robert Ressl WordPress Core is vulnerable to Local File Inclusion via the locate_template() function in various versions up to, and including, 7.1.1. The function resolved a caller-supplied template name against the theme directories without verifying the result stayed within them, so a template name containing '..' could resolve to a readable PHP file outside the active theme and be included. The core-reachable vector is get_page_template(), which builds page-{$pagename}.php from the URL-derived, url-decoded 'pagename' query variable. This makes it possible for unauthenticated attackers to make page-template resolution include a chosen readable local .php file outside the theme directories, which under certain conditions can lead to remote code execution. Exploitation requires (1) the active parent or child theme to contain a top-level directory whose name begins with 'page-' (e.g. 'page-templates' in Twenty Twelve, Twenty Fourteen, Neve, Hestia, Sydney), and (2) a readable .php target on the server accessible to the web-server account (e.g. pearcmd.php with register_argc_argv=On, as in the official PHP Docker image and default cPanel setups on PHP < 8.5), which yields RCE. More Details > We would like to thank Robert Ressl for discovering and responsibly disclosing this vulnerability, as well as the WordPress Security Team and Core contributors who developed, reviewed, tested, and backported the fix. What Makes This Vulnerability Serious What makes this vulnerability serious is that it affects WordPress Core rather than a single optional plugin or theme. An attacker does not need to authenticate, convince an administrator to click a link, or find a separate privilege-escalation vulnerability before reaching the vulnerable page-template logic. At the same time, it is important to describe the impact precisely. CVE-2026-87902 is not an unconditional remote code execution vulnerability on every unpatched WordPress site. The vulnerability first provides a path traversal and local PHP file inclusion primitive. Turning that primitive into code execution depends on the theme and server satisfying additional requirements. The official advisory identifies two principal conditions: The active parent or child theme contains a top-level directory whose name begins with page-, such as page-templates. A PHP file that can produce useful behavior when included exists locally and is readable by the web server account. The relevant directory layout exists in real themes. The WordPress advisory specifically cites the legacy Twenty Twelve and Twenty Fourteen themes, along with Neve, Hestia, and Sydney. Because the advisory does not identify affected theme-version ranges, administrators should verify the installed theme and filesystem rather than assume that every release bearing one of those names is exposed. The advisory also reports that the official PHP Docker image and default cPanel configurations using PHP before 8.5 can expose a known PEAR-based transition from local file inclusion to code execution. Sites that do not meet those requirements may not be exploitable for remote code execution in their current configuration. That should not be treated as a durable mitigation. Themes, plugins, PHP packages, and server settings change over time, and the underlying unauthenticated path traversal remains present until WordPress Core is updated. Technical Analysis WordPress uses a hierarchy of candidate files to decide which template should render a page. In vulnerable releases, get_page_template() reads the public pagename query variable and applies an additional URL-decoding operation before constructing a template candidate: $pagename_decoded = urldecode( $pagename ); $templates[] = "page-{$pagename_decoded}.php"; Request parameters have already been URL-decoded once by the time WordPress processes them. The extra urldecode() means an attacker can submit a doubly encoded value that becomes path traversal syntax only during page-template resolution. WordPress then passes the candidate to locate_template(). In affected versions, that function joins the candidate to an active-theme path and checks whether the resulting file exists. It did not verify that the resolved file remained inside an approved theme directory before load_template() included it. Together, these behaviors allow a crafted page request to escape a compatible page-* directory and point WordPress toward a PHP file elsewhere on the local filesystem. WordPress adds the page- prefix and .php suffix itself, which is why the theme layout and target-file requirements matter. Our end-to-end validation reproduced the behavior on WordPress 7.1. How the Patch Works The WordPress fix adds two complementary protections. First, get_page_template() now checks the decoded page name with validate_file() before adding it to the template candidate list. This rejects the traversal syntax used through the vulnerable pagename path. Second, locate_template() now sends existing candidates through a new _wp_is_template_path_allowed() check. For a path containing traversal components, WordPress resolves its canonical filesystem location and confirms that it remains inside an approved theme or theme-compatibility directory before it can be loaded. The first control closes the known request path. The second adds defense in depth for other Core callers and filters that can provide template names. Who Is Affected The vulnerable and fixed ranges are branch-specific. A simple statement such as “WordPress 7.1.1 and earlier” would be inaccurate because the September 22 security backports are fixed even though their version numbers sort below 7.1.1. Affected versions Update to 7.1.0 through 7.1.1 7.1.2 7.0.0 through 7.0.5 7.0.6 6.9.0 through 6.9.8 6.9.9 6.8.0 through 6.8.9 6.8.10 6.7.0 through 6.7.8 6.7.9 6.6.0 through 6.6.8 6.6.9 6.5.0 through 6.5.11 6.5.12 6.4.0 through 6.4.11 6.4.12 6.3.0 through 6.3.11 6.3.12 6.2.0 through 6.2.12 6.2.13 6.1.0 through 6.1.13 6.1.14 6.0.0 through 6.0.15 6.0.16 5.9.0 through 5.9.17 5.9.18 5.8.0 through 5.8.16 5.8.17 5.7.0 through 5.7.18 5.7.19 5.6.0 through 5.6.20 5.6.21 5.5.0 through 5.5.21 5.5.22 5.4.0 through 5.4.22 5.4.23 5.3.0 through 5.3.24 5.3.25 5.2.0 through 5.2.27 5.2.28 5.1.0 through 5.1.25 5.1.26 5.0.0 through 5.0.28 5.0.29 4.9.0 through 4.9.32 4.9.33 4.8.0 through 4.8.31 4.8.32 4.7.0 through 4.7.36 4.7.37 WordPress.org states that only the newest release in the 7.1 series is actively maintained. The older fixes were supplied as courtesy security backports. Sites on an older branch should apply the available security update immediately and plan an upgrade to a currently maintained WordPress release. Wordfence Protection Wordfence Premium, Wordfence Care, and Wordfence Response customers received firewall protection against attacks targeting CVE-2026-87902 on September 22, 2026, the same day the vulnerability and security updates were released. Wordfence Free users will receive the same protection on October 22, 2026. The dedicated firewall rule detects traversal syntax in the vulnerable pagename input, including the encoded form that remains after the web application firewall’s first decoding pass. As always, the firewall is an important layer of protection, but it is not a substitute for patching WordPress Core. Site owners should update even after firewall protection is active. What Site Owners Should Do Now If you manage a WordPress site, take the following steps immediately: 1 Check the WordPress Core version on every site you manage. 2 Update to WordPress 7.1.2 or to the fixed release listed above for your current branch. 3 Confirm that the update completed. Do not assume an automatic background update succeeded on every site. 4 If immediate updating is temporarily impossible, confirm that an appropriate firewall rule is active, then schedule the Core update as soon as possible. 5 Review web server and firewall logs for suspicious requests containing traversal-like values in the pagename parameter. 6 If you find evidence that a request reached the vulnerable template path, treat the site as potentially compromised. Review administrator accounts, recently installed or modified plugins, scheduled tasks, and unexpected PHP files, and begin a full incident response process. Conclusion CVE-2026-87902 is a serious WordPress Core vulnerability because it is reachable without authentication and can cross a theme-directory boundary to include local PHP code. On sites with a compatible theme layout and server environment, successful exploitation can lead to remote code execution and full site compromise. The environmental requirements mean that not every vulnerable WordPress installation is immediately exploitable for code execution. They do not make it safe to remain on an affected release. The correct remediation is to update WordPress Core to the fixed version for your branch and confirm that the update completed. Wordfence Premium, Care, and Response customers received firewall protection on September 22, 2026, and Wordfence Free users will receive the same protection on October 22, 2026. Patching remains the most important step site owners can take. If you have not already verified that your sites are running WordPress 7.1.2 or the appropriate September 22 security backport, do that now. If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both products include hands-on support if you need further assistance. Primary Sources WordPress Core security advisory GHSA-7hp8-65ch-5whp WordPress Core changeset 63792 WordPress release archive The post PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core appeared first on Wordfence.