WORDPRESS 7.1.2, released on 22 September 2026, fixes an unauthenticated local file inclusion vulnerability tracked as CVE-2026-87902, with a CVSS score of 9.2. The flaw affects versions from 4.7.0 onwards and lies in `get_page_template()`, which builds possible template filenames using the URL’s `pagename` value without applying the file-validation check used elsewhere. After URL decoding, an attacker can use directory traversal to make WordPress include an arbitrary local file, without needing an account.
The vulnerability does not automatically provide arbitrary code execution: an included PHP file runs its existing contents. However, Patchstack says the issue can become remote code execution when a readable PHP file such as PEAR’s `pearcmd.php` is available and PHP has `register_argc_argv` enabled. That setting is enabled by default in official PHP Docker images and in cPanel environments using PHP versions below 8.5.
Exploitation therefore depends on the server’s configuration and files, although the file-inclusion flaw itself is unauthenticated. The article does not report confirmed exploitation.
WordPress’s update adds the missing `validate_file()` check and introduces `_wp_is_template_path_allowed()`, applying a broader validation step to resolved template paths. Administrators should install 7.1.2 or the relevant backported update through the Dashboard or WordPress.org. Those unable to patch immediately can assess exposure by checking whether the active theme contains a folder beginning `page-` and whether `register_argc_argv` is enabled; these checks do not replace updating.