Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

WordPress Fixes High Risk Path Traversal Flaw Enabling Code Execution

Part of the CVE-2026-87902 story · since 22 Sep

Quiet for 6 weekslast report 28 Sep10 articles6 outlets
22 Sep · SecurityOnline first17 Oct25 OctNowThis article1st of 10
  • Tue 22 Sep, 18:01 UTC. SecurityOnline, first report. WordPress Fixes High Risk Path Traversal Flaw Enabling Code Execution. Cites a CVE in CISA KEV. This article, 1st of 10.
  • Wed 23 Sep, 08:47 UTC. Security Affairs, its first report on the story. WordPress Patches Critical Flaw Enabling Conditional Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 17:38 UTC. SecurityOnline. WordPress RCE Flaw Exploited in the Wild as PoC Goes Public. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 07:36 UTC. SecurityWeek, its first report on the story. WordPress Flaw Exploited Within Hours to Gain Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 08:47 UTC. The Hacker News, its first report on the story. Attackers Exploit Critical WordPress Flaw Hours After Disclosure. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 20:01 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited WordPress Flaw Enabling Code Execution. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 08:26 UTC. Security Affairs. CISA Warns of Actively Exploited WordPress Flaw Enabling RCE. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 14:30 UTC. Security Affairs. OpenAI Agents Bypassed Controls on US and Australian Government Sites. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline. Nine Flaws Exploited as Attackers Target Edge Products and WordPress. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. Check Point, its first report on the story. Check Point Warns of Active Exploits and AI-Powered Attacks. Cites a CVE in CISA KEV.

WordPress has released version 7.1.2 to fix CVE-2026-87902, a path-traversal vulnerability rated 8.1 (High) under CVSS v3. The flaw affects WordPress versions up to 7.1.1 and can allow an unauthenticated attacker to read arbitrary files and, under specific server and theme conditions, execute arbitrary code. The article says there is no confirmed exploitation or public proof of concept at present.

The vulnerability is linked to the `get_page_template()` page-template resolution function. An attacker may manipulate it to access a readable `local.php` file outside the active theme directories. Where a theme contains a top-level directory beginning with `page-`, this can enable unauthenticated path traversal and, by targeting particular files, remote code execution. The report cites `pearcmd.php` as a potential target when `register_argc_argv` is enabled.

It identifies Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney among the themes that may increase exposure, and says official PHP Docker images and default cPanel configurations using PHP versions before 8.5 are particularly susceptible.

Administrators should update to WordPress 7.1.2 through the dashboard or the project’s release package. The WordPress core team has reportedly backported the fix to older branches dating back to version 4.7. Site owners should also review their active theme and server configuration, particularly where the conditions described above apply.

How the story developed

All 10 articles
Quiet for 6 weekslast report 28 Sep10 articles6 outlets

10 articles from 6 outlets since 22 Sep. Quiet since 28 Sep. This was the first report.

Now22 Sep242526272829First reportSecurityOnline · 22 Sep, 18:01CISA alert25 Sep, 20:01 · official
  • Tue 22 Sep, 18:01 UTC. SecurityOnline, first report. WordPress Fixes High Risk Path Traversal Flaw Enabling Code Execution. Cites a CVE in CISA KEV. This article, 1st of 10.
  • Wed 23 Sep, 08:47 UTC. Security Affairs, its first report on the story. WordPress Patches Critical Flaw Enabling Conditional Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 17:38 UTC. SecurityOnline. WordPress RCE Flaw Exploited in the Wild as PoC Goes Public. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 07:36 UTC. SecurityWeek, its first report on the story. WordPress Flaw Exploited Within Hours to Gain Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 08:47 UTC. The Hacker News, its first report on the story. Attackers Exploit Critical WordPress Flaw Hours After Disclosure. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 20:01 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited WordPress Flaw Enabling Code Execution. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 08:26 UTC. Security Affairs. CISA Warns of Actively Exploited WordPress Flaw Enabling RCE. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 14:30 UTC. Security Affairs. OpenAI Agents Bypassed Controls on US and Australian Government Sites. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline. Nine Flaws Exploited as Attackers Target Edge Products and WordPress. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. Check Point, its first report on the story. Check Point Warns of Active Exploits and AI-Powered Attacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 10 articles as a list
  1. Tue 22 SepDay 01
    1. WordPress Fixes High Risk Path Traversal Flaw Enabling Code Execution18:01 · SecurityOnline · First report · Exploited CVE · Known exploited CVE · This article, 1st of 10
  2. Wed 23 SepDay 12
    1. WordPress Patches Critical Flaw Enabling Conditional Code Execution08:47 · Security Affairs · Known exploited CVE
    2. WordPress RCE Flaw Exploited in the Wild as PoC Goes Public17:38 · SecurityOnline · Known exploited CVE
  3. Thu 24 SepDay 22
    1. WordPress Flaw Exploited Within Hours to Gain Remote Code Execution07:36 · SecurityWeek · Known exploited CVE
    2. Attackers Exploit Critical WordPress Flaw Hours After Disclosure08:47 · The Hacker News · Known exploited CVE
  4. Fri 25 SepDay 31
    1. CISA Warns of Actively Exploited WordPress Flaw Enabling Code Execution20:01 · CISA · official · CISA alert · Known exploited CVE
  5. Sat 26 SepDay 41
    1. CISA Warns of Actively Exploited WordPress Flaw Enabling RCE08:26 · Security Affairs · Known exploited CVE
  6. Sun 27 SepDay 51
    1. OpenAI Agents Bypassed Controls on US and Australian Government Sites14:30 · Security Affairs · Known exploited CVE
  7. Mon 28 SepDay 62
    1. Nine Flaws Exploited as Attackers Target Edge Products and WordPress02:30 · SecurityOnline · Known exploited CVE
    2. Check Point Warns of Active Exploits and AI-Powered Attacks14:30 · Check Point · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in