On September 22, 2026, WordPress released version 7.1.2, a security release that fixes a critical vulnerability in WordPress core tracked as CVE-2026-87902. The flaw affects how WordPress resolves page templates and can lead to remote code execution on some server configurations. Security firm Patchstack saw probing traffic less than five hours after the patch was published, which makes this one of the more urgent core updates in recent years.
What happened
According to the WordPress 7.1.2 release post, the vulnerability allowed unauthorized page template resolution that could include readable local PHP files outside the active theme directories, which could lead to remote code execution under certain conditions. It was responsibly disclosed by researcher Robert Ressl, and the fix was backported to all branches eligible for security fixes, currently back to 4.7. WordPress recommends updating immediately, and sites with automatic background updates enabled receive the update automatically.
Patchstack's technical write-up describes it as an unauthenticated local file inclusion issue affecting WordPress 4.7.0 through 7.1.1, with a CVSS score of 9.2. Patchstack lists three conditions for the most serious outcome:
- the active theme has a top-level directory whose name begins with "page-";
- a readable PHP file that does something useful when included exists on the server, with PEAR's pearcmd.php named as the main example;
- PHP has register_argc_argv enabled, which Patchstack says is the default in official Docker images and cPanel environments on PHP versions below 8.5.
BleepingComputer reported on September 23 that attackers began reconnaissance less than five hours after the patch release and that malicious activity seen by Patchstack had increased tenfold by the next day. WordPress followed with version 7.1.3 on October 6, 2026, a maintenance and security release with 7 security fixes and 4 bug fixes, according to the WordPress releases page.
Why it matters for companies hiring IT firms
A core flaw affects every WordPress site regardless of which plugins it uses, and the gap between disclosure and attack attempts was measured in hours. If your maintenance contract does not say how quickly security updates are applied, this is a good moment to add it. Sites on shared hosting with cPanel, or running in Docker containers, deserve a closer look because of the PHP configuration Patchstack describes.
When you compare a WordPress development company or a hosting provider, ask how they monitor core security releases, whether automatic minor updates are enabled, and how they review logs after an incident.
Why it matters for IT firms
Agencies that manage many client sites need to confirm that every site is on 7.1.3, or the latest patched release in its branch, and that no site runs a branch older than 4.7, which received no fix. Firms that build custom themes should check for top-level directories starting with "page-", and hosting teams should review register_argc_argv settings and whether pearcmd.php is present. For WooCommerce stores, a compromise can expose order and customer data, so incident response plans should be ready.
What to do next
- Update every WordPress site to the latest release in its branch and confirm the version in the dashboard.
- Review access logs from September 22 onward for unusual requests involving page templates or pearcmd.php.
- Check PHP settings and remove unused PEAR tools where possible.
- Keep automatic background updates enabled for security releases unless you have a tested reason not to.
Need help with maintenance or security? Compare WordPress and hosting providers in the Trusted IT Firms directory.
Frequently asked questions
What is CVE-2026-87902?
It is a critical WordPress core vulnerability in page template resolution, fixed in WordPress 7.1.2 on September 22, 2026. Under certain server conditions it can lead to remote code execution.
Which WordPress versions are affected?
Patchstack lists WordPress 4.7.0 through 7.1.1 as affected. WordPress backported the fix to all branches that receive security fixes, back to 4.7.
Is the vulnerability being exploited?
BleepingComputer, citing Patchstack, reported that attackers began probing sites less than five hours after the patch was released, with activity rising tenfold by the next day.
Is my site safe if automatic updates are on?
Sites with automatic background updates should receive the fix automatically, but you should still confirm the installed version in the dashboard and review your logs.
Sources
Add trusteditfirms.com as a preferred source on Google, or open this page in your AI assistant to use it as a source.
