WordPress 7.1.2 patches core RCE path as attackers move from probes to active exploitation

WordPress released 7.1.2 on September 22 to fix CVE-2026-87902. An unauthenticated attacker can influence page-template resolution so WordPress includes a chosen readable local PHP file outside the active theme directories. Early telemetry showed probing within hours. By September 23, Patchstack and Previdian were observing active exploitation attempts that included pearcmd.php and used it to write attacker-controlled PHP files to /tmp or /var/tmp. Previdian recorded 68 exploitation attempts beginning September 23. WordPress is backporting the fix across security-eligible branches through 4.7.

This is a WordPress Core exposure rather than a vulnerable optional plugin, and it needs no account or victim interaction to reach the vulnerable path. The RCE outcome remains conditional on theme and server configuration, but the threat has progressed beyond scanners merely testing the vulnerable route: attackers are now attempting file writes and payload execution. Sites updated to 7.1.1 only days earlier are still affected, making immediate version verification, patching and compromise hunting important.

The vulnerable path is WordPress Core's get_page_template() resolution. Crafted input can survive sanitisation in encoded form, later decode into traversal sequences and cause WordPress to include a readable local PHP file outside the active theme directories. WordPress describes the flaw as critical and recommends immediate updating.

Local file inclusion does not automatically mean attacker-supplied code executes on every installation. The documented RCE path needs an active theme with a suitable top-level page-* directory and a server-side PHP file whose behaviour is useful when included. Hosting configuration, filesystem contents, PHP settings and theme structure therefore materially affect exploitability, but operators should patch rather than relying on assumed environmental safety.

Patchstack first saw reconnaissance on September 22 using the encoded traversal and page_id combination needed to reach the vulnerable path. Fresh September 23 telemetry shows escalation: attackers are including pearcmd.php and attempting to write attacker-controlled PHP files into locations such as /tmp and /var/tmp. Previdian reported 68 exploitation attempts beginning September 23, while Patchstack independently observed the same shift. These are active exploitation attempts; public telemetry still does not establish how many sites, if any, were successfully compromised.

WordPress 7.1.2 contains the fix for the current release. Security fixes were also backported to maintained older branches, including 7.0.6, 6.9.9 and 6.8.10 and continuing through 4.7.37. Sites should install the patched build for their branch immediately, while recognising that WordPress actively supports only the latest release.