WordPress has just released an update 7.1.2 to urgently patch a critical security vulnerability in the core source code (WordPress Core). The vulnerability is identified as CVE-2026-87902 with a CVSS risk score of 9.2, allowing unauthenticated attackers to load local PHP files (Local File Inclusion – LFI) and potentially escalate to remote code execution (RCE) on some server configurations.

The issue was discovered and privately reported by security expert Robert Ressl through WordPress HackerOne program since July. The affected scope spans all versions from 4.7.0 to 7.1.1 – meaning nearly a decade of WordPress source code.

If you are using the hosting ecosystem or perfect website design services at DPS.MEDIA, you do not need to take any action. All websites hosted at DPS.MEDIA are configured with automatic security monitoring, 24/7 file integrity monitoring and automatic patch updates immediately after release, combined with a completely isolated PHP environment.

However, for administrators managing their own servers or using third-party hosting, understanding how the vulnerability works will help you proactively protect your systems before automated malware scans begin.

Technical mechanism: Double decoding flaw in get_page_template()

The vulnerability lies in how WordPress selects template files when rendering a website page.

An attacker sends an anonymous request to the target page with two familiar parameters:

• page_id: Points to a valid post or page that is currently online. This allows WordPress to receive the request and prepare to return content normally.
• pagename: Contains a directory traversal string encoded twice by URL (double-encoded), such as directory backtracking strings like %252e%252e%252f.

When building the template, the function get_page_template() decodes this parameter value to create the file path. The decode operation transforms the hidden string into a real path, causing traversal to bypass the filter. The template path is redirected outside the allowed theme directory, and WordPress will include any PHP file it finds at that path.

According to analysis documentation from Patchstack, WordPress previously checked traversal for a similar parameter but missed this parameter. Version 7.1.2 added a validation step and introduced a new rule: every resolved template path must be completely within the allowed theme directory.

Activation conditions: Not every website is affected by RCE

The vulnerability has a CVSS score of 9.2, but successful exploitation requires specific environmental conditions:

1. Theme directory structure: The active theme must have a top-level directory beginning with the prefix page-, typically page-templates/. Notably, this was once a structure recommended by WordPress documentation. Recent default themes (Twenty Twenty-Three, Twenty Twenty-Four, Twenty Twenty-Five) do not use this structure, but many old themes and third-party themes on ThemeForest still use it.

2. Escalation conditions from LFI to RCE: Reading PHP files alone is not enough to take control of the server. In Robert Ressl's experimental lab exploits, the escalation chain to remote code execution requires three additional factors:

• The presence of PEAR files (which are available in the official WordPress Docker image).
• Directive register_argc_argv must be enabled in the PHP configuration file (enabled by default on the official PHP Docker image and cPanel running PHP below 8.5).
• A server directory that allows the web process to write files.

When all conditions are met, executable code runs with the permissions of the web server account (www-data or hosting user). The attacker can read file contents wp-config.php to obtain database connection information, modify posts, or inject a webshell.

Warning signs from the continuous Core vulnerability chain

CVE-2026-87902 is the third consecutive WordPress core vulnerability discovered recently:

• wp2shell (July/2026): The no-login code execution vulnerability chain includes CVE-2026-63030 and CVE-2026-60137, which was added by CISA to the KEV catalog (actively exploited vulnerabilities).
• XSS2Shell (August/2026): The CVE-2026-64638 vulnerability in version 7.0.3, turning a failed login into attacker-controlled malicious JavaScript code.
• Click2Shell: Recently fixed in version 7.1.1 to prevent tricking an administrator browser into automatically installing themes containing malicious code.

The discovery of consecutive core vulnerabilities shows that the security community is deeply reviewing older WordPress processing logic. The positive point is that security researcher Robert Ressl followed the responsible disclosure process and no real attacks have been recorded so far. However, because the PoC has been published on GitHub, the time for attackers to convert it into automated scanning bots may only be days.

Update recommendations and risk mitigation measures

If you manage your website yourself, take these steps immediately:

1. Update WordPress to the latest version

Update immediately to WordPress 7.1.2. The WordPress team has also provided backported patches for older branches: 7.0.6, 6.9.9, 6.8.10… extending to the branch 4.7.37 according to the official announcement at WordPress.org Release Announcement. Websites with automatic updates enabled will receive the patch automatically.

2. Temporary measures if immediate updating is not possible

If your website depends heavily on customized plugins and needs testing time before upgrading, apply these temporary solutions immediately:

• Disable directive register_argc_argv = Off in the file php.ini for web requests. This blocks the ability to turn LFI into RCE.
• Remove or disable unnecessary PEAR files in the PHP / Docker container directory.
• Tighten directory write permissions for the PHP process (chmod 755 for folder and chmod 644 for file).

Note: The configuration measures above only temporarily reduce the attack surface and do not replace the official source code patch.

Secure system operation with DPS.MEDIA

At DPS.MEDIA, infrastructure security is the default standard for every project. All customers using our hosting and website management services are protected by:

• Independent segmented server systems, resource isolation and complete blocking of directory traversal behavior at the WAF layer.
• Automatic monitoring and security patching processes immediately after release without interrupting user access experience.
• Engineering teams continuously review malware and perform multi-location daily data backups.

If you need support checking website security or upgrading a safe infrastructure system, contact DPS.MEDIA now for detailed assistance.