WordPress 7.1.2 Patches CVE-2026-87902: Unauthenticated Path Traversal to RCE

WordPress shipped patches on September 22 for a critical, unauthenticated path-traversal flaw in get_page_template() that lets an attacker force a site to load an arbitrary readable local .php file from outside the active theme, turning into remote code execution when server preconditions line up. The bug spans every supported branch back to 4.7.0 through 7.1.1, carries a CVSS 9.2, and needs no account or user interaction to trigger. Notably, it hits even sites that just applied WordPress's September 17 security release (7.1.1) — that update did not touch this issue.

• CVE-2026-87902 rated CVSS 9.2, affecting every WordPress version from 4.7.0 through 7.1.1 with no authentication required.
• Root cause: get_page_template() page-template resolution can be tricked into including an attacker-chosen readable local .php file outside the active theme directories.
• Fixes landed simultaneously across all supported branches, from 7.1.2 down to 4.7.37, so the patch version depends on which branch you're on.
• Sites that updated to 7.1.1 on September 17 for a separate security release are still exposed and need the follow-up 7.1.2 patch.
• Caveat: WordPress itself frames the resulting code execution as conditional, dependent on specific server environment settings, not guaranteed on every host.

Bottom line If you run WordPress on any supported branch, patch to the corresponding fixed version today, including if you already updated on September 17.