Executive Summary
On September 22, 2026, WordPress disclosed CVE-2026-87902, a critical unauthenticated path traversal vulnerability in its page-template resolution logic. The flaw allows attackers to bypass theme directory boundaries to include local PHP files. While the vulnerability is core-based, successful escalation to Remote Code Execution (RCE) depends on specific prerequisites, such as the presence of certain theme directory structures (e.g., directories starting with 'page-') and specific PHP configurations like 'register_argc_argv' being enabled.
Technically, the issue stems from improper handling of decoded URL parameters within the `get_page_template()` function, enabling attackers to escape intended directories using traversal sequences. Active internet scanning and probing were detected by Patchstack within five hours of the patch release, indicating that threat actors are rapidly reverse-engineering security fixes to identify vulnerable targets.
This vulnerability is highly critical due to the massive WordPress install base and the lack of authentication required for exploitation. Even if a site does not meet current known RCE criteria, the underlying LFI primitive remains a significant risk. Immediate patching to WordPress 7.1.2 or the appropriate backported version is strongly recommended for all organizations.