19 October 2026
WordPress released a critical security update, 7.1.2, in response to a zero-day vulnerability that had been patched, but attackers wasted no time trying to exploit it, putting unpatched site operators at urgent risk. The flaw, indexed as CVE-2026-87902, allows unauthenticated local PHP file inclusion, with remote code execution possible on specific server and theme setups, according to an analysis by Patchstack.
The CVE-2026-87902 vulnerability affects every version of WordPress from 4.7.0 through 7.1.1. WordPress noted in its announcement that there is no separate workaround; operators must patch to 7.1.2 to fully mitigate the risk.
The vulnerability ties to WordPress's page-template resolution path. An exploit can direct the software to load a PHP file of an attacker's choosing, located outside of the active theme's directories. But while this aspect of the flaw can be triggered on all affected sites, achieving full remote code execution requires a separate set of conditions on the vulnerable server.
Even so, the separation of concerns means that even if a site DevOps team quickly applied the WordPress 7.1.2 patch, other parts of its PHP software stack may remain exposed to this exploit vector.
Security analyst Patchstack determined that exploitation of CVE-2026-87902 for RCE only succeeds under specific server conditions, so most at-risk sites did not face a catastrophic threat. But the rapid, within-hours exploit attempts spotted by the WordPress community put missing-patch operators at elevated risk.
More on this is available via how to play casino games on your phone in legal US states.
WordPress's security guidance emphasizes that while core updates should be prioritized, patches to popular plugins are often more critical. The security update for WordPress that was announced late last summer, 7.0.8, had a possible exploit of public file upload in the commercial W3Total Cache plugin, raising the risk for sites using that popular caching and performance tool.
SecurityArsenal also noted observations of attempted PHP exploitation in WordPress upload directories. The patch to 7.1.2 is critical, but after updating, administrators must complete a several-step clean-up and verification checklist, including checking vulnerable plugins.
Even more troubling, there are still WordPress sites running on insecure PHP versions that will likely never be updated to meet CVE-2026-87902 patch, and end-of-life WordPress versions are numerous, according to Censys, further raising the opportunity for attackers to find vulnerable content-management systems on the web.
The depth and breadth of the WordPress core's exposure to compromise highlights how current it must be with its full software stack to implement even a standard content management system, requiring not only keeping WordPress current, but also constantly updating PHP, MySQL, and any additional WordPress helper software involved.
