As reported by The Hacker News, WordPress has shipped an emergency patch for CVE-2026-87902 — a critical vulnerability rated CVSS 9.2 that affects virtually every supported WordPress branch from 4.7.0 through 7.1.1. The flaw lives in how WordPress constructs template filenames from URL-derived input, and it permits an unauthenticated attacker to traverse outside intended theme directories and load arbitrary PHP files.
Why This Matters More Than a Typical Path Traversal
Path traversal bugs are common, but this one deserves attention for three reasons. First, it requires no authentication and no interaction from a logged-in user — a bot can scan and exploit it at internet scale. Second, the affected version range is enormous: every site running 4.7.0 through 7.1.1 is vulnerable, including sites updated as recently as September 17. Third, while WordPress is careful to note that full code execution depends on a secondary condition, the conditions are not rare. Many themes — including older default WordPress themes — ship top-level folders beginning with page-, and register_argc_argv is still enabled by default on older PHP configurations that remain widely deployed in shared hosting environments.
The gap between 'can load a PHP file' and 'can execute attacker code' is narrow on a meaningful percentage of WordPress installations. Defenders should not assume they are in the safe subset.
Vulnerability Summary
| Identifier | CVE-2026-87902 |
|---|---|
| CVSS | 9.2 — Critical |
| Affected Versions | WordPress 4.7.0 through 7.1.1 (all supported branches) |
| Patched Version | 7.1.2 (backported to 7.0.6, 6.9.9, 6.8.10, 6.7.9, 6.6.9, and 4.7.37+) |
| Exploitation Pre-requisites | Unauthenticated; full RCE additionally requires theme with page-* folder and register_argc_argv enabled |
| Active Exploitation | Not yet confirmed in the wild at time of analysis — but expect rapid scanning |
| Workaround | None — patching is the only remediation |
Who Is Most Exposed
Shared hosting environments are the highest-risk segment. These deployments tend to run older PHP versions where register_argc_argv is enabled by default, and they frequently host themes that include page- prefixed directories. Long-tail WordPress sites — small business sites, blogs, and marketing pages that receive infrequent maintenance — are also prime targets because they are less likely to apply patches within hours of release. Enterprise WordPress deployments running PHP 8.5+ with hardened configurations and minimal theme inventories face a lower likelihood of full RCE, but still suffer from the underlying file-disclosure path traversal and should not delay patching.
Beyond Patching: Hardening the Surface
The source article correctly notes there is no workaround, but defenders can reduce residual risk while patches propagate:
- Disable
register_argc_argvinphp.iniif it is not required by any application. This removes a key condition for the known RCE chain and is a PHP hardening best practice. - Audit active theme directories for top-level folders matching
page-*. If present and unused, consider removing or renaming the theme to reduce exploitability. - Deploy WAF rules that block path traversal sequences (
../) in URL parameters reaching WordPress template handlers. This provides defense-in-depth but is not a substitute for the patch. - Verify automatic background updates are enabled — WordPress states these installations will self-update, but monitor to confirm success, especially on multisite or custom deployments where auto-updates may be disabled.
Shield53 Recommendations
register_argc_argv = Off in your PHP configuration and restart PHP-FPM or the web server.../ sequences or unusual page- parameter values dating back to at least September 17, when 7.1.1 was released.WordPress powers roughly 40% of the web, and vulnerabilities of this severity in core software are relatively uncommon. The speed and breadth of WordPress's backporting — down to 4.7 — signals they recognize the exposure is real. Defenders should match that urgency.
