WordPress 7.1.2 has been released to fix a critical-severity security vulnerability that can allow an unauthenticated attacker to include a readable local PHP file outside the active theme directories. If the active parent or child theme contains a top-level directory beginning with page- and the server has a suitable readable PHP file, the vulnerability can lead to remote code execution.
The vulnerability and the patch
The vulnerability, tracked as CVE-2026-87902, has a CVSS 4.0 score of 9.2 and was responsibly disclosed by security researcher Robert Ressl, who reported it through the WordPress HackerOne program on July 20, 2026. WordPress acknowledged the report the following day and informed Ressl on September 15 that a fix was planned for an upcoming release.
The vulnerability affects the way WordPress resolves page templates. Wordfence also provided technical details on how it works. The vulnerable get_page_template() function uses the pagename value from a request to construct a page template filename. In affected versions, an additional URL-decoding step could turn an encoded path traversal sequence into a path that points outside the theme directory.
The resulting template candidate is passed to locate_template(). In affected versions, the resolved file was not checked to ensure it remained within an approved theme directory before being loaded. WordPress adds the page- prefix and .php extension to the template name, making the theme’s directory structure and the location of the target PHP file relevant to exploitation.
Ressl’s research found that the demonstrated attack requires a published Page that can be selected through page_id, no earlier valid assigned custom template, a suitable top-level page- directory in a theme root, and an existing readable local PHP file. The directory can be in the active child theme or its parent theme, and the target file does not need to be writable.
The attack does not require a WordPress account, cookie, session, nonce, plugin or user interaction. Ressl tested the vulnerability using WordPress 7.0.2 in three fresh, isolated laboratory environments. He said the evidence does not establish that every default WordPress installation is exploitable, with the complete attack chain depending on the theme layout and runtime conditions.
In Ressl’s demonstrated environment, pearcmd.php provided a route from local file inclusion to PHP execution. That route depended on the PEAR components being available, register_argc_argv being enabled for web requests, and a writable location for the generated PHP file. Ressl said changing those conditions can break the demonstrated route, but does not address the underlying WordPress file-inclusion flaw.
In his testing, the generated file belonged to www-data, and the testing did not demonstrate operating-system privilege escalation or root access. No third-party or production WordPress site was tested.
Patchstack described it as “the most serious thing WordPress has patched in a while” and also noted seeing probing attempts against the vulnerability less than five hours after WordPress 7.1.2 was published.
WordPress 7.1.2 addresses the issue with two changes. The first adds a validate_file() check to the decoded page name before it is added to the list of template candidates. The second adds a new _wp_is_template_path_allowed() check to resolved template paths. This check confirms that a path involving traversal remains within an approved theme or theme-compatibility directory before WordPress loads it.
Ressl also recommends additional hardening measures to reduce potential file-inclusion-to-execution paths. These include disabling register_argc_argv for web requests when it is not needed, removing unused web-readable PEAR entry points, and restricting the PHP account’s filesystem access and write permissions.
The security fix has also been backported to WordPress branches as far back as 4.7.
A series of recent security releases
WordPress has seen a series of security releases in recent months. WordPress 7.1.1, released on September 17, included 11 security fixes, while 7.0.4 on August 12 addressed a remote code execution vulnerability. These followed 7.0.3 on August 6, which fixed 12 security vulnerabilities, and 7.0.2 on July 17, which addressed a critical pre-authentication remote code execution vulnerability and a high-severity SQL injection vulnerability.