WordPress CVE-2026-87902: unauth page-template traversal → RCE — actively exploited; CISA KEV 25 Sep

UPDATE 23–24 Sep 2026: BleepingComputer reports threat actors moved from probing to exploiting CVE-2026-87902 to write files that execute shell commands when accessed. Patchstack saw first malicious requests at 17:44 UTC on 22 September 2026 (under five hours after WordPress 7.1.2 shipped), then ~10× traffic increase delivering payloads. Flaw: unauthenticated get_page_template() path traversal to include a chosen readable local .php outside active theme dirs; RCE needs theme top-level page-* dir plus a readable include target (e.g. pearcmd.php with register_argc_argv). WordPress/GHSA rate Critical (~9.2 CVSS 4.0 UI; NVD/CISA secondary CVSS 3.1 8.1 High). Official PHP Docker image and default cPanel on PHP <8.5 called out. Fix: 7.1.2 with backports through eligible branches to 4.7 (pre-4.6 unfixed). Distinct from click2shell/comment2shell (7.1.1). UPDATE 25 Sep 2026: CISA added CVE-2026-87902 to KEV (dateAdded 2026-09-25). Primary: WordPress 7.1.2 + GHSA; exploitation wire: BleepingComputer 23 Sep 2026; KEV: CISA.

Product

WordPress core (get_page_template() page-template resolution)

Versions

Affected: WordPress before 7.1.2 (incl. 7.1.0–7.1.1 and prior supported lines); security fix backported through eligible branches to 4.7. Fixed: 7.1.2 (+ matching backports). Releases before 4.6 will not receive a fix.

CVSS

8.1 (CVSS 3.1 High; NVD/CISA secondary) / Critical (GHSA; CVSS 4.0 ~9.2)

Exploited in Australia?

unknown

Patch to

Update to WordPress 7.1.2 or the security backport for your branch immediately; prioritize internet-facing sites on PHP <8.5 (incl. common cPanel defaults); review themes with top-level page-* directories; hunt for unexpected .php drops / template include probes since 22 Sep 17:44 UTC

Primary: WordPress — 7.1.2 security release / CVE-2026-87902 (22 Sep 2026) · Vendor: GHSA-7hp8-65ch-5whp — unauthenticated page-template path traversal · CVE: CVE-2026-87902 · BleepingComputer — active exploitation of CVE-2026-87902 (23 Sep 2026); also Patchstack observations

vulnerabilities australia cloud