{"id":40870,"date":"2026-09-23T09:29:53","date_gmt":"2026-09-23T02:29:53","guid":{"rendered":"https:\/\/dps.media\/cve-2026-87902-lo-hong-file-inclusion-wordpress\/"},"modified":"2026-09-23T09:29:53","modified_gmt":"2026-09-23T02:29:53","slug":"cve-2026-87902-serious-file-inclusion-vulnerability-wordpress","status":"publish","type":"post","link":"https:\/\/dps.media\/en\/cve-2026-87902-serious-file-inclusion-vulnerability-wordpress\/","title":{"rendered":"CVE-2026-87902: Serious File Inclusion Vulnerability on WordPress and How to Handle It"},"content":{"rendered":"<?xml encoding=\"utf-8\" ?><p>WordPress has just released an update <strong>7.1.2<\/strong> to urgently patch a serious security vulnerability in the core source code (WordPress Core). The vulnerability is identified as <strong>CVE-2026-87902<\/strong> with a CVSS risk score of <strong>9.2<\/strong>, allowing unauthenticated attackers to load local PHP files (Local File Inclusion \u2013 LFI) and potentially escalate to remote code execution (RCE) on some server configurations.<\/p><p>The issue was discovered and privately reported by security expert Robert Ressl through WordPress HackerOne program in July. The affected scope spans all versions from <strong>4.7.0<\/strong> to <strong>7.1.1<\/strong> \u2013 nearly a decade of WordPress source code.<\/p><p>If you are using the hosting ecosystem or <a href=\"https:\/\/dps.media\/en\/website-design-services-2\/\">perfect website design services<\/a> at DPS.MEDIA, you do not need to take any action. All websites hosted at DPS.MEDIA are configured with automatic security monitoring, 24\/7 file integrity monitoring and automatic patch updates immediately after release, combined with a completely isolated PHP environment.<\/p><p>However, for administrators who operate their own servers or use third-party hosting, understanding how the vulnerability works will help you proactively protect against automated malware scanning campaigns.<\/p><h2>Technical mechanism: Double decoding flaw in get_page_template()<\/h2><p>The vulnerability lies in how WordPress selects template files when rendering a website page.<\/p><p>The attacker sends an anonymous request to the target page with two familiar parameters:<\/p><ul>\n<li><code class=\"notranslate no-translate\" data-no-translation=\"\">page_id<\/code>: Points to a valid post or page that is online. This allows WordPress to accept the request and prepare to return content normally.<\/li>\n<li><code class=\"notranslate no-translate\" data-no-translation=\"\">pagename<\/code>: Contains a directory traversal string that is URL encoded twice (double-encoded), such as directory level backtracking strings like <code class=\"notranslate no-translate\" data-no-translation=\"\">%252e%252e%252f<\/code>.<\/li>\n<\/ul><p>When building the template, the function <code class=\"notranslate no-translate\" data-no-translation=\"\">get_page_template()<\/code> decodes this parameter value to create the file path. The decoding operation transforms the hidden string into an actual path, causing the traversal to bypass the filter. The template path is redirected outside the permitted theme directory, and WordPress will include any PHP file it finds at that path.<\/p><p>According to analysis documentation from <a href=\"https:\/\/patchstack.com\/articles\/wordpress-7-1-2-security-release-unauthenticated-lfi-to-rce\/\" target=\"_blank\" rel=\"noopener nofollow\">Patchstack<\/a>, WordPress previously checked traversal for a similar parameter but missed this parameter. Version 7.1.2 adds a validation step and applies a new rule: every resolved template path must be completely inside the allowed theme directory.<\/p><p><img decoding=\"async\" src=\"https:\/\/dps.media\/wp-content\/uploads\/2026\/09\/cve_2026_87902_lo_hong_file_in_img2_1790130166274.png\" alt=\"CVE-2026-87902\" style=\"display:block; margin:20px auto; max-width:100%; height:auto;\" title=\"\"><\/p><h2>Activation conditions: Not every website is affected by RCE<\/h2><p>The vulnerability has a CVSS score of 9.2, but successful exploitation requires specific environmental conditions:<\/p><p><strong>1. Theme directory structure:<\/strong> The active theme must have a top-level directory starting with the prefix <code class=\"notranslate no-translate\" data-no-translation=\"\">page-<\/code>, typically being <code class=\"notranslate no-translate\" data-no-translation=\"\">page-templates\/<\/code>. Notably, this was once a structure recommended by WordPress documentation. Recent default themes (Twenty Twenty-Three, Twenty Twenty-Four, Twenty Twenty-Five) do not use this structure, but many old themes and third-party themes on ThemeForest still use it.<\/p><p><strong>2. Escalation condition from LFI to RCE:<\/strong> Reading PHP files alone is not enough to take over a server. In Robert Ressl real-world lab experiments, the exploitation chain escalating to remote code execution requires three additional factors:<\/p><ul>\n<li>The presence of PEAR files (which are included in the official WordPress Docker image).<\/li>\n<li>Directive <code class=\"notranslate no-translate\" data-no-translation=\"\">register_argc_argv<\/code> is enabled in the PHP configuration (enabled by default on the official PHP Docker image and cPanel running PHP below 8.5).<\/li>\n<li>A directory on the server allows the web process to write files.<\/li>\n<\/ul><p>When all these conditions are met, executable code runs with the privileges of the web server account (<code class=\"notranslate no-translate\" data-no-translation=\"\">www-data<\/code> or hosting user). The attacker can read the contents of the file <code class=\"notranslate no-translate\" data-no-translation=\"\">wp-config.php<\/code> to obtain database connection information, modify posts or inject a webshell.<\/p><h2>Warning signs from a series of Core vulnerabilities<\/h2><p>CVE-2026-87902 is the third consecutive WordPress core vulnerability appearing recently:<\/p><ul>\n<li><strong>wp2shell (July\/2026):<\/strong> A no-login code execution vulnerability chain including CVE-2026-63030 and CVE-2026-60137, which was added by CISA to the KEV catalog (actively exploited vulnerabilities).<\/li>\n<li><strong>XSS2Shell (August\/2026):<\/strong> The CVE-2026-64638 vulnerability in version 7.0.3, turning a single incorrect login into malicious JavaScript controlled by attackers.<\/li>\n<li><strong>Click2Shell:<\/strong> Recently fixed in version 7.1.1 to prevent tricking an administrator browser into automatically installing themes containing malicious code.<\/li>\n<\/ul><p>The continuous discovery of core vulnerabilities shows that the security community is deeply reviewing old WordPress processing logic. The positive point is that security researcher Robert Ressl followed the responsible disclosure process and no real attacks have been recorded so far. However, because the PoC has been published on GitHub, the time for attack groups to convert it into automated scanning bots may only be days.<\/p><h2>Recommendations for updating and risk mitigation measures<\/h2><p>If you manage your website yourself, perform the following steps immediately:<\/p><h3>1. Update WordPress to the latest version<\/h3><p>Update immediately to <strong>WordPress 7.1.2<\/strong>. The WordPress team has also provided backported patches for older branches: <code class=\"notranslate no-translate\" data-no-translation=\"\">7.0.6<\/code>, <code class=\"notranslate no-translate\" data-no-translation=\"\">6.9.9<\/code>, <code class=\"notranslate no-translate\" data-no-translation=\"\">6.8.10<\/code>\u2026 extending to branch <code class=\"notranslate no-translate\" data-no-translation=\"\">4.7.37<\/code> according to the official announcement at <a href=\"https:\/\/wordpress.org\/news\/2026\/09\/wordpress-7-1-2-release\/\" target=\"_blank\" rel=\"noopener nofollow\">WordPress.org Release Announcement<\/a>. Websites with automatic update features enabled will automatically receive the patch.<\/p><h3>2. Temporary measures if you cannot update immediately<\/h3><p>If the website depends heavily on customized plugins and needs testing time before upgrading, immediately apply these temporary solutions:<\/p><ul>\n<li>Disable directive <code class=\"notranslate no-translate\" data-no-translation=\"\">register_argc_argv = Off<\/code> in the file <code class=\"notranslate no-translate\" data-no-translation=\"\">php.ini<\/code> for web requests. This blocks the ability to turn LFI into RCE.<\/li>\n<li>Remove or disable unnecessary PEAR files in the PHP \/ Docker container directory.<\/li>\n<li>Tighten write permissions for the PHP process (<code class=\"notranslate no-translate\" data-no-translation=\"\">chmod 755<\/code> for folder and <code class=\"notranslate no-translate\" data-no-translation=\"\">chmod 644<\/code> for file).<\/li>\n<\/ul><p>Note: The above configuration measures only temporarily reduce the attack surface and do not replace the official source code patch.<\/p><p><img decoding=\"async\" src=\"https:\/\/dps.media\/wp-content\/uploads\/2026\/09\/cve_2026_87902_lo_hong_file_in_img3_1790130267203.png\" alt=\"CVE-2026-87902\" style=\"display:block; margin:20px auto; max-width:100%; height:auto;\" title=\"\"><\/p><h2>Operate your system securely with DPS.MEDIA<\/h2><p>At DPS.MEDIA, infrastructure security is the default standard for every project. All customers using our hosting and website management services are protected by:<\/p><ul>\n<li>Independent segmented server systems, resource isolation and complete blocking of directory traversal behaviors at the WAF layer.<\/li>\n<li>Automatic processes for monitoring and patching security issues immediately upon release without interrupting user access experience.<\/li>\n<li>Engineering teams continuously reviewing malware and performing multi-point data backups daily.<\/li>\n<\/ul><p>If you need website security checks or safe infrastructure upgrades, contact DPS.MEDIA now for detailed support.<\/p><div class=\"dps-contact-box\" style=\"margin-top: 30px; padding: 20px; background: #f8fafc; border-left: 4px solid #32b561; border-radius: 8px;\">\n<p style=\"margin: 0 0 8px 0; font-weight: bold; font-size: 16px; color: #151577;\">DPS.MEDIA JOINT STOCK COMPANY<\/p>\n<p style=\"margin: 0 0 6px 0;\">\ud83d\udccd <strong>Address:<\/strong> 56 Nguyen Dinh Chieu, Tan Dinh Ward, Ho Chi Minh City<\/p>\n<p style=\"margin: 0 0 6px 0;\">\ud83d\udcde <strong>Hotline \/ Zalo:<\/strong> <a href=\"tel:0961545445\" style=\"color: #32b561; font-weight: bold;\">0961 545 445<\/a><\/p>\n<p style=\"margin: 0 0 6px 0;\">\u2709 <strong>Email:<\/strong> <a href=\"mailto:marketing@dps.media\">marketing@dps.media<\/a><\/p>\n<p style=\"margin: 0 0 6px 0;\">\ud83c\udf10 <strong>Website:<\/strong> <a href=\"https:\/\/dps.media\/en\/\" target=\"_blank\" rel=\"noopener\">https:\/\/dps.media<\/a><\/p>\n<p style=\"margin: 0;\">\ud83c\udfe2 <strong>Tax code:<\/strong> 0318700500 | <strong>VCB:<\/strong> 1051160909<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Ph\u00e2n t\u00edch chi ti\u1ebft l\u1ed7 h\u1ed5ng CVE-2026-87902 (CVSS 9.2) tr\u00ean WordPress core, c\u01a1 ch\u1ebf khai th\u00e1c File Inclusion leo thang RCE v\u00e0 gi\u1ea3i ph\u00e1p b\u1ea3o v\u1ec7 h\u1ec7 th\u1ed1ng website.<\/p>","protected":false},"author":0,"featured_media":40867,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1724,2479,70],"tags":[675],"class_list":["post-40870","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cong-nghe","category-thiet-ke-web","category-tin-tuc","tag-dps-media"],"acf":[],"rankmath_keywords":{"primary":"CVE-2026-87902, l\u1ed7 h\u1ed5ng WordPress 7.1.2, WordPress File Inclusion RCE, l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt WordPress 2026, c\u1eadp nh\u1eadt WordPress 7.1.2","secondary":["l\u1ed7 h\u1ed5ng WordPress 7.1.2","WordPress File Inclusion RCE","l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt WordPress 2026","c\u1eadp nh\u1eadt WordPress 7.1.2"]},"yoast_keywords":{"primary":"","secondary":[]},"yoast_focuskw":"","rankmath_focuskw":"CVE-2026-87902, l\u1ed7 h\u1ed5ng WordPress 7.1.2, WordPress File Inclusion RCE, l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt WordPress 2026, c\u1eadp nh\u1eadt WordPress 7.1.2","seo_keywords":{"primary":"CVE-2026-87902, l\u1ed7 h\u1ed5ng WordPress 7.1.2, WordPress File Inclusion RCE, l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt WordPress 2026, c\u1eadp nh\u1eadt WordPress 7.1.2","secondary":["l\u1ed7 h\u1ed5ng WordPress 7.1.2","WordPress File Inclusion RCE","l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt WordPress 2026","c\u1eadp nh\u1eadt WordPress 7.1.2"]},"_links":{"self":[{"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/posts\/40870","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/comments?post=40870"}],"version-history":[{"count":0,"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/posts\/40870\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/media\/40867"}],"wp:attachment":[{"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/media?parent=40870"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/categories?post=40870"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dps.media\/en\/wp-json\/wp\/v2\/tags?post=40870"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}