WordPress ships a critical security fix
WordPress released version 7.1.2 on 22 September to fix CVE-2026-87902, a critical unauthenticated flaw in page-template resolution. The project recommends that site operators update immediately. Its GitHub advisory assigns the issue a CVSS v4 base score of 9.2 and records no privilege or user-interaction requirement.
The project also published patched releases for older branches back to WordPress 4.7. The advisory lists fixed versions from 7.1.2 and 7.0.6 through 4.7.37. WordPress stresses that these backports are a courtesy and that only the latest WordPress version is actively supported.
The flaw crosses the theme-directory boundary
The vulnerable path is `get_page_template()` resolution. An unauthenticated request can cause WordPress to include a chosen readable local `.php` file outside the active theme directories. That creates a local-file inclusion boundary failure before any application-level authentication is required.
Remote code execution requires additional deployment conditions. The active parent or child theme must contain a top-level directory whose name begins with `page-`, and a suitable PHP target must exist and be readable by the web-server account. The advisory names legacy Twenty Twelve and Twenty Fourteen plus several third-party themes as examples of the first condition, and describes server configurations that can satisfy the second.
Patch scope is unusually broad
The affected-version table spans WordPress 7.1.0 through 7.1.1 and older branch ranges down to 4.7.0 through 4.7.36. The corresponding patched releases increment each maintained security branch, including 6.9.9, 6.8.10, 6.7.9 and equivalent fixes through 4.7.37. That gives operators on legacy branches a direct security update even though the project recommends moving to the current release line.
The broad backport does not mean every installation has the same practical exposure. Theme layout and PHP/server configuration determine whether the documented route can progress from path traversal to code execution. Those prerequisites are useful for incident triage, but they are a poor reason to postpone a security update because configurations can change and the underlying unauthenticated inclusion flaw remains present on affected versions.
What remains uncertain
The WordPress release and GitHub advisory reviewed for this story establish the vulnerability, severity, affected ranges and fixes. They do not report a measured population of exploitable sites or state that attacks have been observed in the wild. Any claim about active exploitation, scanning volume or real-world prevalence needs separate incident-response or telemetry evidence.
Community discussion helped surface the release but is not part of the confirmation chain. WordPress has shipped the fix and published the affected and patched version matrix, while the operational risk for an individual site still depends on its theme and server environment.