Critical WordPress vulnerability affects versions dating back to 2016

CVE-2026-87902 at a glance

WordPress released the fix on 22nd September 2026 and recommends updating immediately. Its official security advisory gives the flaw a CVSS score of 9.2 out of 10. The rating is Critical because the request does not require a login or a click from an administrator, and a successful chain can end in remote code execution.

What the flaw changes in WordPress

When somebody opens a page, WordPress works out which template file the active theme should use. The vulnerable part sits in that template resolution. A specially formed request can make get_page_template() step outside the theme directories and include another readable PHP file already present on the same server.

That is serious, but the last part is important. The flaw does not simply let an attacker upload any program and run it on every WordPress website. They need a useful local PHP file to be available, and the active theme must have a particular directory structure. Remote code execution becomes possible when those pieces line up.

The distinction should shape the response. It is not a reason to postpone the update, especially now that the patch is public and probing has started. It is a reason to avoid telling every owner of an outdated site that their website has definitely been taken over.

Which websites meet the known conditions?

The theme condition is a top-level folder whose name begins with page-, in either the active parent or child theme. WordPress names the older Twenty Twelve and Twenty Fourteen themes as examples. The advisory also mentions Neve, Hestia, and Sydney, although the presence of one of those themes does not by itself prove that the full attack chain will work.

The server then needs a readable local PHP file that can be used to move from file inclusion to code execution. One documented route involves a PHP PEAR utility and the register_argc_argv setting. The WordPress advisory says the official PHP Docker image meets that server condition, as does the default cPanel configuration when it runs a PHP version earlier than 8.5.

If either condition is absent, this specific route to remote code execution is incomplete. Checking them can help a developer judge past exposure, but changing a theme or PHP setting is not a substitute for patching WordPress. The vulnerable template handling still belongs in core, and the fixed release removes it there.

Probing began within hours, but probing is not a breach

Patchstack says it first saw attempts at 17:44 UTC on 22nd September, less than five hours after WordPress 7.1.2 was published. The requests matched the encoding addressed by the patch and were sent across several protected sites, which is consistent with somebody building a list of vulnerable hosts.

At the time of publication, every target in those requests was an ordinary WordPress core file. The activity was testing whether the inclusion worked, not delivering attacker-controlled PHP. That does not make the scanning harmless, but it does mean a matching request in an access log is not enough on its own to declare the site compromised.

The timing still matters. Once a security patch is public, the changed code helps attackers understand what was fixed. Here, the gap between release and scanning was measured in hours. Updating before a working attack chain becomes widely automated is much easier than proving what happened afterwards.

Install the right WordPress security release

WordPress 7.1.2 is the current fixed release. Sites deliberately held on an older branch also have a patched build: 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, and 6.5.12 are the most recent examples. The fix continues through every branch down to WordPress 4.7.37, and the advisory lists the exact release for each one.

Those backports make a rapid security update possible without combining it with a major-version migration. They are not a promise of long-term support. WordPress only actively supports its latest release, so a site kept on an old branch still needs a separate plan to move forward once the immediate risk is closed.

Take a current backup, then open Dashboard > Updates and install the newest release offered for the site. Confirm the version after WordPress finishes, clear any full-page or edge cache, and check a few important pages, forms, account screens, and checkout steps. If automatic background updates are enabled, verify that the update completed rather than assuming it did.

What to check after the update

Start with access logs for the period before the site was patched. Patchstack highlights requests where pagename contains double-encoded traversal text such as %252e%252e, especially when pagename and page_id appear together on the home page or index.php. Similar requests can arrive through either GET or POST, so checking only the query string may miss part of the picture.

A request in the log shows that somebody knocked on the door. The response tells you more. Unexpected OPML or other core-file output returned from a normal page URL suggests the inclusion succeeded on that host. If you find that response, treat the site as having had a confirmed vulnerable window and widen the review.

A practical review should cover:

• unexpected or recently modified PHP files across WordPress, not only inside the active theme
• core files that no longer match the clean files from the installed WordPress release
• administrator accounts, plugins, themes, and must-use plugins nobody recognises
• scheduled tasks, configuration changes, and new files created during the vulnerable period
• server and security logs for what happened after a successful probe

Preserve suspicious files and useful logs before cleaning anything. If compromise is confirmed, remove the malicious code, close every persistence route you find, and then rotate affected credentials. Deleting the first odd file without understanding what created it can hide evidence while leaving the attacker another way back.

Patch quickly, then follow the evidence

CVE-2026-87902 has the ingredients that make a core vulnerability uncomfortable: no login is required, the potential impact is high, and probing started on release day. It also has clear preconditions, a complete set of security releases, and no confirmed payload delivery in the activity reported so far. Both sides of that picture matter.

Update first. Then check the theme and server conditions, look at the requests and responses your own site handled, and investigate more deeply where the evidence justifies it. That is a calmer response than assuming the worst, and a safer one than deciding the conditions sound too specific to worry about.

BugShield maintenance plans include monitored plugin, theme, and core updates through our managed WordPress update service. If logs show a successful probe, or the site already contains files and users you do not recognise, our WordPress malware removal service can investigate the files, database, users, scheduled tasks, and likely entry point.

For a single site, you can also request a one-off WordPress fix. Whichever route you choose, the useful finish line is not simply seeing an update notice disappear. It is knowing the fixed release is installed and that the site's own evidence has been checked in proportion to its exposure.