Published on September 24, 2026 · The mitza.es team
WordPress released version 7.1.2 on September 22, 2026, fixing CVE-2026-87902, a critical vulnerability rated CVSS 9.2 out of 10. What stands out isn't just the severity: the flaw affects every WordPress version released between 4.7.0 and 7.1.1 — essentially a decade of installations, from late 2016 until this month's patch.
Where the flaw sits, and why no password is needed
The problem lives in get_page_template(), the function WordPress uses to decide which theme template file to load for a page. Insufficient validation of path-traversal characters (../) in values derived from the URL lets an attacker redirect that lookup to .php files outside the theme folder. No account, password, or action from a logged-in user is required: the attack arrives through a plain HTTP request.
Which versions are protected
- 7.1.x branch: update to 7.1.2.
- 7.0.x branch: update to 7.0.6.
- 6.9.x branch: update to 6.9.9.
- 6.8.x branch: update to 6.8.10.
- 6.7.x branch: update to 6.7.9.
- 6.6.x and earlier, down to 4.7: update to 6.6.9 or the equivalent maintenance release, as far back as 4.7.37.
Exploitation started in hours, not days
Security firm Patchstack detected the first malicious requests against vulnerable sites at 17:44 UTC on September 22 itself — less than five hours after the patch was published. Within a day, attack traffic multiplied tenfold, with attackers moving beyond probing to actually writing malicious PHP files to the server to execute commands. Robert Ressl, the researcher who found the flaw, published a proof of concept the same day the patch shipped, accelerating the race between whoever updates first and whoever attacks first.
When the flaw turns into remote code execution
Loading files outside the theme is serious on its own, but turning it into remote code execution requires three conditions at once: the active theme must have a folder whose name starts with page- (for example, page-templates), the server must contain a .php file readable by the web server user, and that file must be able to execute code from external parameters — as happens with PEAR's pearcmd.php when register_argc_argv is enabled. Without those three conditions, the immediate risk is lower, but an attacker can still read server files they shouldn't have access to, so updating remains the priority regardless of each site's specific configuration.
What to do if you run a WordPress site
Update to the patched version of your branch as soon as possible; if your installation hasn't been touched in a while and sits below 4.7.37, jump straight to the latest stable release. This isn't the first time this year that WordPress core has been at the center of a bulletin like this: back in July we covered the wp2shell flaw chain, and the pattern repeats: the longer an SME takes to update, the longer it stays exposed to something that already has a published fix. Our IT maintenance service includes checking and updating WordPress installations, and if your site is carrying an installation that's become hard to maintain, we can also scope a more controlled custom build from scratch.