WordPress has just released an update 7.1.2 to urgently patch a serious security vulnerability in the core source code (WordPress Core). The vulnerability is identified as CVE-2026-87902 with a CVSS risk score of 9.2, allowing unauthenticated attackers to load local PHP files (Local File Inclusion – LFI) and potentially escalate to remote code execution (RCE) on some server configurations.

The issue was discovered and privately reported by security expert Robert Ressl through WordPress HackerOne program in July. The affected scope spans all versions from 4.7.0 to 7.1.1 – nearly a decade of WordPress source code.

If you are using the hosting ecosystem or perfect website design services at DPS.MEDIA, you do not need to take any action. All websites hosted at DPS.MEDIA are configured with automatic security monitoring, 24/7 file integrity monitoring and automatic patch updates immediately after release, combined with a completely isolated PHP environment.

However, for administrators who operate their own servers or use third-party hosting, understanding how the vulnerability works will help you proactively protect against automated malware scanning campaigns.

Technical mechanism: Double decoding flaw in get_page_template()

The vulnerability lies in how WordPress selects template files when rendering a website page.

The attacker sends an anonymous request to the target page with two familiar parameters:

• page_id: Points to a valid post or page that is online. This allows WordPress to accept the request and prepare to return content normally.
• pagename: Contains a directory traversal string that is URL encoded twice (double-encoded), such as directory level backtracking strings like %252e%252e%252f.

When building the template, the function get_page_template() decodes this parameter value to create the file path. The decoding operation transforms the hidden string into an actual path, causing the traversal to bypass the filter. The template path is redirected outside the permitted theme directory, and WordPress will include any PHP file it finds at that path.

According to analysis documentation from Patchstack, WordPress previously checked traversal for a similar parameter but missed this parameter. Version 7.1.2 adds a validation step and applies a new rule: every resolved template path must be completely inside the allowed theme directory.

Activation conditions: Not every website is affected by RCE

The vulnerability has a CVSS score of 9.2, but successful exploitation requires specific environmental conditions:

1. Theme directory structure: The active theme must have a top-level directory starting with the prefix page-, typically being page-templates/. Notably, this was once a structure recommended by WordPress documentation. Recent default themes (Twenty Twenty-Three, Twenty Twenty-Four, Twenty Twenty-Five) do not use this structure, but many old themes and third-party themes on ThemeForest still use it.

2. Escalation condition from LFI to RCE: Reading PHP files alone is not enough to take over a server. In Robert Ressl real-world lab experiments, the exploitation chain escalating to remote code execution requires three additional factors:

• The presence of PEAR files (which are included in the official WordPress Docker image).
• Directive register_argc_argv is enabled in the PHP configuration (enabled by default on the official PHP Docker image and cPanel running PHP below 8.5).
• A directory on the server allows the web process to write files.

When all these conditions are met, executable code runs with the privileges of the web server account (www-data or hosting user). The attacker can read the contents of the file wp-config.php to obtain database connection information, modify posts or inject a webshell.

Warning signs from a series of Core vulnerabilities

CVE-2026-87902 is the third consecutive WordPress core vulnerability appearing recently:

• wp2shell (July/2026): A no-login code execution vulnerability chain including CVE-2026-63030 and CVE-2026-60137, which was added by CISA to the KEV catalog (actively exploited vulnerabilities).
• XSS2Shell (August/2026): The CVE-2026-64638 vulnerability in version 7.0.3, turning a single incorrect login into malicious JavaScript controlled by attackers.
• Click2Shell: Recently fixed in version 7.1.1 to prevent tricking an administrator browser into automatically installing themes containing malicious code.

The continuous discovery of core vulnerabilities shows that the security community is deeply reviewing old WordPress processing logic. The positive point is that security researcher Robert Ressl followed the responsible disclosure process and no real attacks have been recorded so far. However, because the PoC has been published on GitHub, the time for attack groups to convert it into automated scanning bots may only be days.

Recommendations for updating and risk mitigation measures

If you manage your website yourself, perform the following steps immediately:

1. Update WordPress to the latest version

Update immediately to WordPress 7.1.2. The WordPress team has also provided backported patches for older branches: 7.0.6, 6.9.9, 6.8.10… extending to branch 4.7.37 according to the official announcement at WordPress.org Release Announcement. Websites with automatic update features enabled will automatically receive the patch.

2. Temporary measures if you cannot update immediately

If the website depends heavily on customized plugins and needs testing time before upgrading, immediately apply these temporary solutions:

• Disable directive register_argc_argv = Off in the file php.ini for web requests. This blocks the ability to turn LFI into RCE.
• Remove or disable unnecessary PEAR files in the PHP / Docker container directory.
• Tighten write permissions for the PHP process (chmod 755 for folder and chmod 644 for file).

Note: The above configuration measures only temporarily reduce the attack surface and do not replace the official source code patch.

Operate your system securely with DPS.MEDIA

At DPS.MEDIA, infrastructure security is the default standard for every project. All customers using our hosting and website management services are protected by:

• Independent segmented server systems, resource isolation and complete blocking of directory traversal behaviors at the WAF layer.
• Automatic processes for monitoring and patching security issues immediately upon release without interrupting user access experience.
• Engineering teams continuously reviewing malware and performing multi-point data backups daily.

If you need website security checks or safe infrastructure upgrades, contact DPS.MEDIA now for detailed support.