WORDPRESS has released version 7.1.2 to fix CVE-2026-87902, a path-traversal vulnerability rated 8.1 (High) under CVSSv3. The flaw affects WordPress versions up to 7.1.1 and can allow an unauthenticated attacker to read arbitrary files and potentially execute code, but only under specific server and theme conditions. The report says there is no confirmed exploitation or public proof of concept at present.
The vulnerability lies in the `get_page_template()` page-template resolution function. An attacker may be able to make WordPress access a readable `local.php` file outside the active theme directories when the theme contains a top-level directory beginning with `page-`. Under suitable conditions, this can lead to remote code execution, including through `pearcmd.php` when `register_argc_argv` is enabled. Themes identified as potentially affected include Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney.
The report also highlights official PHP Docker images and default cPanel configurations using PHP versions before 8.5 as higher-risk environments.
Site owners should upgrade to WordPress 7.1.2 through the administrative dashboard or the official release package. The WordPress core team has reportedly backported the fix to older branches dating back to version 4.7. Administrators should also review their active themes and PHP server configuration.