WordPress 7.1.2 Patches a Critical Path Traversal to RCE: Update Now

A serious vulnerability was disclosed in the WordPress core codebase: an unauthenticated path traversal bug that, under the right server conditions, can escalate to remote code execution. That combination, no login required plus potential RCE, puts this near the top of the priority list for any WordPress site owner or host. Here is what the vulnerability is, who is affected, and exactly what to do about it.

💡 Why This Matters

Path traversal vulnerabilities let an attacker reference files outside the intended directory by injecting sequences like ../ into a request. On their own they are dangerous. Chained with a code execution primitive, they become critical.

The "conditional" part of this disclosure means RCE is not guaranteed on every WordPress install. Server configuration, PHP settings, and installed plugins or themes all influence whether the traversal can be weaponised into execution. But "conditional" does not mean "safe to ignore." Attackers will probe for the conditions that make it work, and many shared hosting and default VPS setups are likely to qualify.

The advisory is GHSA-7hp8-65ch-5whp in the WordPress develop repository, and it is CVE-2026-87902, rated Critical at CVSS 4.0 9.2. Every release from 4.7.0 through 7.1.1 is affected. WordPress shipped 7.1.2 on 22 September 2026 along with backports to every branch still eligible for security fixes, down to 4.7.37. Treat this as urgent rather than theoretical: CISA added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog on 25 September 2026, and public scanning tooling plus attempts to write PHP files through pearcmd.php are already being seen in the wild.

🧰 Prerequisites: Who Should Read This

• Anyone running a self-hosted WordPress site on 4.7.0 or later, which in practice means anyone running WordPress
• Hosting providers and managed WordPress hosts
• Homelab builders running WordPress internally (yes, even private sites)
• DevOps teams with WordPress in staging or CI pipelines

If WordPress is running somewhere you control, this post is for you.

🔍 How the Vulnerability Works

The flaw is in one specific thing: page template resolution. An unauthenticated request can steer get_page_template() into including a chosen readable local .php file from outside the active theme's directories. That makes it a local file inclusion rather than a generic web root escape, and it is classed as CWE-98, improper control of filename for an include or require statement.

The conditions are narrower and far more specific than 'a misconfigured server', and they are worth checking against your own install rather than guessing. The file inclusion needs the active theme, parent or child, to contain a top level directory whose name begins with page-. That is not exotic: page-templates/ ships in Twenty Twelve and Twenty Fourteen and in popular themes including Neve, Hestia and Sydney. Turning that inclusion into code execution needs two more things: a readable .php file on the server that will act on attacker supplied arguments, in practice pearcmd.php, and register_argc_argv set to On. Official PHP Docker images and default cPanel configurations on PHP before 8.5 both qualify. For the precise code path, refer to the official security advisory.

🛠️ Step-by-Step: Patching Your WordPress Install

The most important action is updating WordPress core. On the current branch that means 7.1.2. If you are held back on an older branch there is a backport for it, 7.0.6, 6.9.9, 6.8.10, 6.7.9 and so on all the way down to 4.7.37, so being unable to move to 7.1 is not a reason to stay unpatched. Here is how to update cleanly.

Step 1: Back up your database and files before touching anything.

# Example using WP-CLI to export the database
wp db export backup-$(date +%F).sql --allow-root

Step 2: Update WordPress core via WP-CLI (recommended for server installs).

wp core update --allow-root
wp core version --allow-root

Step 3: Confirm the installed version matches the patched release listed in the advisory.

wp core version --allow-root

Step 4: If you manage WordPress through a hosting dashboard (cPanel, Plesk, Kinsta, etc.), use the built-in one-click updater or auto-update toggle. Confirm the version number in the WordPress admin under Dashboard, then About.

Step 5: Enable automatic background updates for minor releases if you have not already. Add this to your wp-config.php:

define( 'WP_AUTO_UPDATE_CORE', 'minor' );

This ensures security patches ship automatically without waiting for manual intervention.

🛡️ Hardening: Reduce the Attack Surface Regardless of Version

Patching fixes the specific bug. Hardening reduces the blast radius of the next one.

Block PHP execution in the uploads directory. Worth doing, but be clear that it does not mitigate CVE-2026-87902, which includes a .php file already present on the server rather than one an attacker uploaded. Keep it as general hygiene against the next upload driven bug. For Nginx, add this to your server block:

location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}

For Apache, drop a .htaccess file inside wp-content/uploads/:

<Files "*.php">
    Require all denied
</Files>

Disable file editing in the WordPress admin. Add to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

Break the RCE preconditions if you cannot patch within the hour. Set register_argc_argv = Off in your PHP configuration and confirm it with php -i | grep register_argc_argv. Then check whether a reachable pearcmd.php exists at all, with find / -name pearcmd.php 2>/dev/null, and remove it if nothing on the box needs PEAR. Neither of these closes the file inclusion, but together they remove the documented route from inclusion to code execution. Patching is still the fix.

Run WordPress behind a WAF. Cloudflare, Wordfence, or a self-hosted option like ModSecurity can catch traversal patterns at the request layer before they reach PHP. Even a free Cloudflare plan adds meaningful filtering.

Restrict xmlrpc.php and wp-login.php by IP if possible. Unauthenticated attack surface shrinks dramatically when admin endpoints are IP-locked.

# Nginx example: restrict wp-login.php
location = /wp-login.php {
    allow [your-admin-IP];
    deny all;
}

🔧 Troubleshooting Common Update Issues

WP-CLI command not found: Install it by following the official WP-CLI installation guide at wp-cli.org. On most Linux servers it is a single curl download and chmod.

Update fails due to file permissions: WordPress needs write access to its own directory during updates. Check that the web server user (often www-data on Ubuntu/Debian) owns the WordPress files.

chown -R www-data:www-data /var/www/html/

Site breaks after update: Restore from the backup taken in Step 1, then investigate plugin or theme conflicts. Deactivate all plugins and retest. The WordPress support forums and the WP-CLI --debug flag are your friends here.

Managed host shows no update available: Some managed hosts patch at the server level before surfacing a WordPress core update. Contact support to confirm your environment is running the patched version.

✅ Wrap Up

Unauthenticated path traversal leading to conditional RCE is the kind of vulnerability that gets actively exploited fast, especially against WordPress given its enormous install base. The fix is straightforward: update core to the patched release, turn register_argc_argv off if nothing on the server needs it, and put automatic minor updates on so future patches land without delay.

The patched version is 7.1.2, or the backport for whichever branch you are on. The official advisory (GHSA-7hp8-65ch-5whp) has the full backport list and the code path. Patch first, harden second, and since this one is already on CISA's exploited list, check your access logs for requests carrying page- template names or pearcmd while you are in there.

Related from the lab

• CrowdSec: Community-Powered Security
• Fail2Ban Setup (Homelab Security Part 2)
• Better Homelab Secret Management with Infisical

Originally published at codewithromi.com.