CVE-2026-87902: WordPress Page-Template Traversal Is Being Exploited - Patch to 7.1.2 Today

The Situation

On 22 September 2026, WordPress shipped 7.1.2 as a security-only release. The GHSA is GHSA-7hp8-65ch-5whp / CVE-2026-87902. Severity on the advisory is critical. GitHub's CVSS v4 on that advisory is 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). That score is vendor/GHSA-reported, not an NVD-enriched v3 we independently recomputed.

WordPress's own news post is blunt: an unauthenticated attacker can, under certain conditions, make page-template resolution include a chosen readable local PHP file outside the active theme directories. If both the server environment and the active theme preconditions are met, that can become remote code execution.

The fix was backported all the way to the 4.7 branch. 4.6 and earlier do not get security updates.

Exploitation status, labeled: On 24 September 2026, SecurityWeek reported that Patchstack saw exploitation attempts within hours of disclosure, then activity that they described as escalating to compromises by 23 September. That is Patchstack telemetry as reported by SecurityWeek. We did not independently confirm packet captures or victim counts. CVE-2026-87902 is not in CISA's KEV catalog in the JSON feed we pulled this morning (catalog dateReleased 2026-09-23, 1721 entries). Absence from KEV is not a reason to wait.

If you sell or run WordPress on shared hosting, this is not "another plugin CVE." It is core, it is unauthenticated, and WordPress itself names default cPanel PHP before 8.5 and the official PHP Docker image in the RCE precondition list.

What WordPress Says Is Required

Do not treat this as "every WordPress on the internet is RCE-able." The GHSA lists preconditions. Quote the facts, then stop:

Theme layout. The active child or parent theme has a top-level directory whose name starts with page- (example given: page-templates). WordPress names the legacy Twenty Twelve and Twenty Fourteen themes, plus third-party Neve, Hestia, and Sydney. A page-about.php template file is not that directory.
A readable local .php file the web-server account can include. The advisory names the well-known pearcmd.php PEAR → RCE transition when register_argc_argv is On.
Environments WordPress itself flags for that PHP setting: the official php Docker image, and default cPanel when PHP is older than 8.5.

Robert Ressl, who reported it through HackerOne, is explicit in his own write-up: PEAR is not a WordPress dependency; the demonstrated execution path is conditional; he did not demonstrate host escape or root; modern default themes (Twenty Twenty-Three / Four / Five) lacked the page-* directory in the versions he inspected. Those are researcher statements, not fleet measurements.

The underlying defect is still local file inclusion through template resolution. Disabling register_argc_argv or removing PEAR breaks one named RCE path. It does not patch WordPress. Update core.

We are not publishing request shapes, encodings, or PEAR invocations. The advisory and the patched wp-includes/template.php are the operator artifacts you need.

Version Floors

From WordPress 7.1.2 documentation and the GHSA patched-version list. Anything below the floor on that branch is vulnerable.

7.1.x → 7.1.2
7.0.x → 7.0.6
6.9.x → 6.9.9
6.8.x → 6.8.10
6.7.x → 6.7.9
6.6.x → 6.6.9
6.5.x → 6.5.12
6.4.x → 6.4.12
6.3.x → 6.3.12
6.2.x → 6.2.13
6.1.x → 6.1.14
6.0.x → 6.0.16
5.9.x → 5.9.18
5.8.x → 5.8.17
5.7.x → 5.7.19
5.6.x → 5.6.21
5.5.x → 5.5.22
5.4.x → 5.4.23
5.3.x → 5.3.25
5.2.x → 5.2.28
5.1.x → 5.1.26
5.0.x → 5.0.29
4.9.x → 4.9.33
4.8.x → 4.8.32
4.7.x → 4.7.37
4.6 and earlier: no security updates. Upgrade the branch.

Sites with automatic background updates for security releases should already have pulled this. Do not assume they did - inventory.

What to Do Now

1. Inventory core versions

Single site:

wp core version --allow-root --path=/home/USER/public_html

cPanel box, every account (adjust the find root if you don't use /home):

find /home -maxdepth 3 -type f -name wp-includes -prune -o -name version.php -print 2>/dev/null \
  | while read f; do
      grep -H "wp_version =" "$f"
    done

Anything not on the floor above is a patch candidate. Treat internet-facing sites first.

2. Patch - this is the mitigation

wp core update --allow-root --path=/home/USER/public_html
wp core version --allow-root --path=/home/USER/public_html

Or Dashboard → Updates → Update Now. There is no published workaround that replaces the core update. WordPress's news post recommends updating immediately.

On a fleet, pin the target version in your image/Ansible so a restored backup does not boot 7.1.1.

3. Hardening that is not the patch

These cut the named PEAR execution path. They do not fix template traversal.

PHP register_argc_argv: WordPress says default cPanel PHP before 8.5 has this On. CLI php -i is not the web pool. Check the INI the site actually uses:

# EasyApache PHP (cPanel) - inspect, don't assume one version
grep -n register_argc_argv /opt/cpanel/ea-php*/root/etc/php.ini 2>/dev/null

Set register_argc_argv = Off in the FPM/LSAPI INI for that account, then recycle PHP. Confirm via a one-line phpinfo() on that vhost, then delete it.

PEAR entry points: if you do not need PEAR from the web account, it should not be a web-readable .php in a path PHP can include. Removing unused PEAR is environment-specific; do not blindly rm on a box you have not inventoried.

Theme layout: list top-level page-* dirs in active themes. Presence is a precondition, not a compromise indicator:

wp theme list --status=active --allow-root --path=/home/USER/public_html
# then, in that theme (and parent) root:
ls -ld page-* 2>/dev/null

4. Hunt, without a PoC

RCE, when the chain completes, runs as the PHP/web-server account (Ressl: www-data in lab; on cPanel that is typically the account uid, not root). Look for unexpected PHP written recently, especially under tmp:

find /tmp /var/tmp /home/*/tmp -name '*.php' -mtime -7 2>/dev/null
find /home/*/public_html -name '*.php' -mtime -4 ! -path '*/wp-content/uploads/*' 2>/dev/null
wp user list --allow-root --path=/home/USER/public_html --fields=user_login,user_email,user_registered,roles

A hit is suspicious, not proof of this CVE. Correlate with access logs around 22-25 September 2026. If you restore, patch before the site is public again.

Why Hosting Operators Should Care More Than Site Owners

Two facts from the GHSA, not our inference:

Unauthenticated. No WP account, no plugin, no admin click.
Default cPanel PHP < 8.5 is in the vendor's RCE-precondition sentence, next to the official PHP Docker image.

On shared hosting you do not control every theme. Twenty Twelve / Fourteen still exist as parent themes. Neve / Hestia / Sydney are common. One unpatched tenant with a page-* directory and PEAR-readable PHP is a webshell as that uid. That is not hypervisor escape. It is still credential theft, spam, SEO spam, and a pivot into the next WordPress on the same account.

This is a different class of bug from last week's LiteSpeed Enterprise tenant-to-root (LSWS 6.3.7, CageFS-bypass language in cPanel's 14 September advisory) and from cPanel CalDAV CVE-2026-87899 (account → root, fixed builds 11.134.0.57 / 11.136.0.41 / 11.138.0.8, disclosed 22 September). Those are authenticated-to-the-panel isolation failures. CVE-2026-87902 is anonymous-to-the-site. Patch both classes. Do not let one ticket close the other.

What We Don't Know Yet

Honesty section - do not skip:

Not in CISA KEV as of this morning's catalog pull. We will not invent a KEV date.
Exploitation in the wild is Patchstack as reported by SecurityWeek (24 Sep 2026). Volume, success rate, and payload families are unverified here.
CVSS 9.2 is CVSS v4 on the GHSA. The AT:P (attack requirements present) flag matches the theme/PHP preconditions. Do not quote a CVSS v3 we did not find on that advisory (cvss v3 fields were null on the GitHub API object).
How many live sites satisfy the theme + PEAR + register_argc_argv chain is unmeasured. Ressl said he did not measure prevalence.
No host/root escape in the researcher's lab write-up.
Mechanism internals (how sanitization and urldecode interact) are described in the researcher's post. We are not reproducing them. The patched file WordPress lists is /wp-includes/template.php.

Track: the GHSA, WordPress 7.1.2 notes, CISA KEV JSON. If a KEV row appears, treat remaining unpatched internet-facing sites as compromise-until-proven-otherwise, not "we'll catch the next window."

Sources

WordPress - 7.1.2 security release (22 Sep 2026)
WordPress - Version 7.1.2 documentation (backports through 4.7.37)
GitHub - GHSA-7hp8-65ch-5whp / CVE-2026-87902 (published 2026-09-22)
Robert Ressl - CVE-2026-87902 write-up (researcher; conditions and lab limits)
SecurityWeek - Critical WordPress vulnerability exploited immediately after disclosure (24 Sep 2026; cites Patchstack)
CISA KEV JSON - https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (pulled 2026-09-25; CVE-2026-87902 not present)