Quick answer: CVE-2026-87902 is a CVSS 9.2 flaw in WordPress core that lets an attacker with no login load PHP files from outside your theme, and on some servers run code. It affects every version from 4.7 to 7.1.1. Exploitation began the same day as the September 22 fix. Update to 7.1.2 (or 7.0.6 / 6.9.9 / 6.8.10) now.
Most WordPress security news is about plugins. In 2025, about 91% of the 11,334 disclosed WordPress vulnerabilities were in plugins and only six were in core (the full picture). This one is different. It is in the part of WordPress every site runs, whatever plugins it has.
What is CVE-2026-87902?
It is an unauthenticated path traversal in the way WordPress core picks a page template. A crafted request can make WordPress include a readable .php file from anywhere on the server instead of a template from your theme. That is a local file inclusion. On servers that also have the right PHP setup, the included file can be turned into code execution, which means a full site takeover.
The flaw was reported privately in July by researcher Robert Ressl and fixed on September 22, 2026. The fix was backported to every supported branch down to 4.7.
How fast was it exploited?
Faster than almost anyone patches.
| When (UTC) | What happened |
|---|---|
| Sept 22 | WordPress ships 7.1.2 and the backports |
| Sept 22, 11:49 | First exploit attempt recorded, the same day |
| Sept 22, 15:34 | First attempts to escalate to code execution |
| Sept 23 | Public exploit tools circulate; sites compromised |
| Sept 25 | CISA adds it to its Known Exploited Vulnerabilities catalog |
| Sept 23–27 | 30,813 distinct IPs attacking WordPress sites; daily volume up from ~15,000 to 124,154 signals and still rising |
Patchstack's median time from disclosure to mass exploitation is about 5 hours. This one landed inside that window.
Is my site actually exposed?
Not every site can be taken over. Full exploitation needs two things:
- Your active theme has a top-level folder whose name starts with
page-. SecurityWeek lists Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney among the affected themes. - Your server's PHP has
register_argc_argvenabled and a file like PEAR'spearcmd.phpis readable. According to WordPress's advisory, the setting is on by default in older PHP versions and off by default from PHP 8.5.
Attackers don't check these conditions first. They send the request to every WordPress site they can find, which is why the traffic numbers are so large. Update even if you think your site doesn't qualify.
What should I do today?
- Check your version. Dashboard → Updates. You want 7.1.2, 7.0.6, 6.9.9 or 6.8.10 (or the patched release on your older branch). If background updates are on, WordPress has probably installed it already. Confirm it; don't assume.
- If you can't update right away, ask your host to block traversal sequences (
%2e%2e) in thepagenameparameter and to turn offregister_argc_argv. - Look for signs you were hit before you patched. Unexpected
.phpfiles in/tmpor/var/tmp, and access-log requests containingpearcmd, are the clearest signals. - If you find something, treat it as an incident. Here is what to do in the next hour.
Who shouldn't worry too much?
If your site takes automatic core updates, is on a current PHP version and runs a theme without a page- folder, the practical risk was small and is now closed. The usual advice is still good: managed hosting, automatic updates and a lean plugin list.
The bigger lesson is about the model, not this one bug. "Keep your plugins lean" did nothing this time, because the flaw was in core. As long as a site runs WordPress, a same-day patch race is part of owning it. If that race is worth leaving, here is what the alternatives cost and which one fits your kind of site.
FAQ
Which WordPress versions are affected by CVE-2026-87902?
WordPress 4.7.0 through 7.1.1. Fixed releases are 7.1.2, 7.0.6, 6.9.9 and 6.8.10, with backports on every older supported branch down to 4.7.37. Sites with automatic background updates enabled should have received the fix without doing anything.
Is CVE-2026-87902 being exploited?
Yes. Patchstack recorded the first attempt on September 22, the day the patch shipped. Public exploit tools and real compromises followed on September 23. CISA added it to its Known Exploited Vulnerabilities catalog on September 25, and CrowdSec saw more than 30,000 attacking IPs in five days.
Does updating my plugins protect me?
No. This flaw is in WordPress core, so plugin updates and a short plugin list make no difference. Only updating WordPress itself closes it. If you can't update immediately, your host can block the traversal pattern and disable the PHP setting the code-execution step relies on.
Can every WordPress site be taken over through this bug?
No. A full takeover needs a theme with a top-level folder starting with page- and a PHP configuration that allows the PEAR trick. Many sites don't meet both conditions. Attackers try every site anyway, so the safe move is to update regardless.
Sources: WordPress patch coverage — The Hacker News, Sept 22, Patchstack — exploitation timeline, SecurityWeek — exploited immediately after disclosure, CrowdSec — 30,000 IPs in five days, CISA KEV addition, Sept 25, Patchstack — State of WordPress Security in 2026. Details as reported at the time of writing; check the official WordPress release notes for current versions.