WordPress 7.1.2 patches core RCE path as attackers move from probes to active exploitation

WordPress released 7.1.2 on September 22 to fix CVE-2026-87902. An unauthenticated attacker can influence page-template resolution so WordPress includes a chosen readable local PHP file outside the active theme directories. Early telemetry showed probing within hours. By September 23, Patchstack and Previdian were observing active exploitation attempts that included pearcmd.php and used it to write attacker-controlled PHP files to /tmp or /var/tmp. Previdian recorded 68 exploitation attempts beginning September 23. WordPress is backporting the fix across security-eligible branches through 4.7. On September 25, CISA added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation and set September 28, 2026 as the federal remediation deadline.

This is a WordPress Core exposure rather than a vulnerable optional plugin, and it needs no account or victim interaction to reach the vulnerable path. The RCE outcome remains conditional on theme and server configuration, but the threat has progressed beyond scanners merely testing the vulnerable route: attackers are now attempting file writes and payload execution. Sites updated to 7.1.1 only days earlier are still affected, making immediate version verification, patching and compromise hunting important. CISA's KEV listing materially strengthens the exploitation evidence and makes the flaw a formal remediation priority for covered U.S. federal civilian agencies; CISA also urges other organizations to prioritize KEV vulnerabilities.

The vulnerable path is WordPress Core's get_page_template() resolution. Crafted input can survive sanitisation in encoded form, later decode into traversal sequences and cause WordPress to include a readable local PHP file outside the active theme directories. WordPress describes the flaw as critical and recommends immediate updating.

Local file inclusion does not automatically mean attacker-supplied code executes on every installation. The documented RCE path needs an active theme with a suitable top-level page-* directory and a server-side PHP file whose behaviour is useful when included. Hosting configuration, filesystem contents, PHP settings and theme structure therefore materially affect exploitability, but operators should patch rather than relying on assumed environmental safety.

Patchstack first saw reconnaissance on September 22 using the encoded traversal and page_id combination needed to reach the vulnerable path. Fresh September 23 telemetry shows escalation: attackers are including pearcmd.php and attempting to write attacker-controlled PHP files into locations such as /tmp and /var/tmp. Previdian reported 68 exploitation attempts beginning September 23, while Patchstack independently observed the same shift. These are active exploitation attempts; public telemetry still does not establish how many sites, if any, were successfully compromised.

WordPress 7.1.2 contains the fix for the current release. Security fixes were also backported to maintained older branches, including 7.0.6, 6.9.9 and 6.8.10 and continuing through 4.7.37. Sites should install the patched build for their branch immediately, while recognising that WordPress actively supports only the latest release.

On September 25, CISA added CVE-2026-87902 to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The catalog sets September 28 as the remediation deadline for covered federal civilian agencies and points agencies to BOD 26-04 risk-based remediation and forensic-triage requirements. The deadline is federal, but the KEV designation is a stronger exploitation signal for other operators too.