Word Press Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
Summary: WordPress released version 7.1.2 on September 22 to fix a critical core flaw, CVE-2026-87902 with a CVSS score of 9.2, that lets an unauthenticated attacker make a site load a PHP file from outside its theme folders, which on some servers can lead to code execution. Every version from 4.7.0 through 7.1.1 is affected, including 7.1.1 from the September 17 security release, and WordPress backported the fix to supported branches down to 4.7.37 with no separate workaround offered.
Bottom line: A site that updated less than a week ago is still exposed, and reaching the worst case depends on conditions already present on the server: an active theme with a top-level folder starting with page-, and register_argc_argv, which is on by default on older PHP versions. As of September 22 there were no reports of exploitation and no CISA KEV entry, so the window is open but not yet observed.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-87902
- Related
- CVE-2026-87902: Word Press Core Remote File Inclusion Vulnerability Known Exploited Vulnerabilities · Sep 25, 2026