WordPress’s Critical CVE-2026-87902 Patch: What Site Owners Need to Do Now

WordPress shipped version 7.1.2 on September 22, 2026 to close a critical, unauthenticated flaw in how the software picks a template file for a page. If you run WordPress and haven’t updated this week, that gap is the first thing worth closing.

The flaw, tracked as CVE-2026-87902, carries a CVSS score WordPress itself rates at 9.2, critical. It affects every version from 4.7.0 through 7.1.1, which means even sites that applied WordPress’s September 17 security release are still exposed; this is a separate bug from the ones that release fixed. WordPress backported the fix all the way down to version 4.7.37, further than most projects bother to go, which says something about how seriously the core team is treating it.

How CVE-2026-87902 actually works

WordPress builds the filename for a page’s template using a value pulled from part of the URL. In affected versions, that value never passed through the same path-traversal check that neighboring code already used elsewhere in WordPress core. An attacker with no account and no login could exploit this, and WordPress would load whatever local PHP file that path pointed to, sitting outside the active theme’s own folders entirely.

Security researcher Robert Ressl, who reported the bug privately through WordPress’s HackerOne program back in July, published a proof-of-concept and a self-contained test lab once the fix shipped. His demonstration ran code with the privileges of the web-server account rather than full server control, tested against WordPress 7.0.2 in an isolated lab rather than a live or patched site.

Why it isn’t full remote code execution on every site

Loading a local PHP file just runs whatever that file already does; it doesn’t hand an attacker a blank slate. Turning this into code execution of the attacker’s own choosing needs a second condition WordPress itself flags in its advisory: the server has to already have a PHP file on disk that does something useful when loaded. That’s the “some servers” qualifier in WordPress’s own description of the bug, and it’s the reason this isn’t automatically catastrophic on every install.

The attack also depends on naming. Because the vulnerable code builds the filename as page-{value}.php, a working exploit needs the active theme to have a top-level folder whose name starts with page-, with the target file ending in .php. Some older default WordPress themes ship a folder that fits that pattern; the current default themes don’t.

Patchstack’s analysis names two checks that indicate exposure without fixing anything: whether the active theme has a page--prefixed top-level folder, and whether the PHP setting register_argc_argv is turned on, since a known code-execution technique depends on it. That setting is off by default starting in PHP 8.5, but on by default on older PHP versions, which is a meaningful share of hosting.

Who’s actually exposed

Realistically, the sites at highest risk are running an older theme with a page--prefixed folder structure, on a PHP version below 8.5 with default settings, and haven’t updated core since before September 22. That’s a narrower slice than “every WordPress site,” but it’s not a rare combination either: plenty of sites run inherited themes years past their last audit, on whatever PHP version their host happened to default to at signup.

When the patch shipped, WordPress reported no confirmed exploitation, but that changed within hours: exploitation attempts were logged starting on September 22, the day of the fix, and CISA added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog on September 25, 2026. Treat this as an actively exploited flaw, not a theoretical one.

How to check whether your own site is realistically exposed

You don’t need a security firm to get a rough read on your own risk before you even apply the update. Log into your hosting control panel or ask your host which PHP version your site runs; if it’s anything below 8.5, treat register_argc_argv as a live question rather than assume it’s off. Next, look at your active theme’s folder structure through FTP or your file manager: a top-level folder literally named starting with page- (common in some older, heavily customized or pre-block-editor themes) is the specific tell Patchstack calls out. None of this replaces updating; it just tells you how much urgency to attach to it if you’re juggling several sites and have to triage.

What to actually do right now

There’s no workaround here beyond updating; WordPress didn’t publish one, because the fix has to live in the template-resolution code itself. The update you need depends on your branch:

Older branches back to 4.7 have their own patched releases listed in WordPress’s release notes. If your site has automatic background updates enabled, this one should start automatically; check your Updates screen to confirm rather than assume. If you manage updates manually, don’t wait for a routine maintenance window on this one. Whichever route you take, take a full backup (files and database) immediately before updating, not after.

Core updates on this scale are low-risk in WordPress’s own track record, but a heavily modified theme or an old plugin that assumes an older core behavior is exactly the kind of thing that breaks quietly on an update and gets discovered a week later, by which point the backup you skipped would have made the fix a two-minute rollback instead of a rebuild.

If for some reason you genuinely can’t update immediately (a heavily customized install that needs compatibility testing first, for instance), Ressl’s own write-up suggests two partial mitigations: turn off register_argc_argv for web requests, and remove unused PEAR components from the server. Neither of those repairs the underlying flaw; they only narrow the path from file inclusion to actual code execution. Treat them as a stopgap measured in hours, not a substitute for the update.

The pattern worth noticing

This is the second WordPress core vulnerability disclosed this month alone, and 2026 has already produced at least one flaw that ended up on CISA’s actively-exploited list. None of that means WordPress is uniquely unsafe; it’s the most-used CMS on the web by a wide margin, which makes it the most economically attractive target to probe. It does mean that “I’ll update WordPress when I get to it” is a habit worth breaking, particularly on a shared or unmanaged VPS where nobody else is watching for this on your behalf.

If your hosting plan includes managed core updates or a staging environment to test a patch before it hits your live site, this is exactly the kind of release where using it is worth the extra five minutes. AllCloudHost’s WordPress hosting plans handle core security releases like this one without waiting on a manual login, which is the difference between closing a fast window and a slow one.

If you administer a site that’s still running an unpatched version and you have reason to think it may have already been probed successfully rather than just scanned, check for unfamiliar files in your uploads directory and any PHP files outside your theme folder that you don’t recognize. The update closes the door going forward; it doesn’t undo anything that already got through it.

Further reading: WordPress developer handbook: security.