WordPress 7.1.2 Patches CVE-2026-87902: Unauthenticated Path Traversal to RCE
WordPress shipped patches on September 22 for a critical, unauthenticated path-traversal flaw in get_page_template() that lets an attacker force a site to load an arbitrary readable local .php file from outside the active theme, turning into remote
Built from 2 signals across 2 sources ยท 864 items reviewed