On 22 September 2026 WordPress released version 7.1.2, which closes a critical flaw numbered CVE-2026-87902. According to the security advisory, a person without an account on the site can, under certain conditions, make WordPress include a chosen readable PHP file from the server, and that can lead to remote code execution. The advisory rates it 9.2 on CVSS 4.0. The flaw is in all versions from 4.7.0 to 7.1.1, and there is a fix for the older branches too. It was responsibly reported by Robert Ressl.
Are you affected?
Every version from 4.7.0 to 7.1.1 contains the flaw. The fix is one version per branch. The table shows the four newest branches, and for older ones there are versions down to 4.7.37, for example 6.7.9 and 6.6.9. The full list is in the advisory.
| Branch | Fixed version |
|---|---|
| 7.1 | 7.1.2 |
| 7.0 | 7.0.6 |
| 6.9 | 6.9.9 |
| 6.8 | 6.8.10 |
You can see your version in Tools > Site Health > Info, in the WordPress section. If you have Terminal in cPanel, you can also see it with the command below. It only reads and returns the version number. More WP-CLI commands are in the WP-CLI guide.
# cPanel > Terminal, in the site's folder, read-only
wp core version
Two conditions must be met for code execution. The first condition is that the active theme, child or parent, has a top-level directory whose name starts with page-, for example page-templates. According to the advisory this affects the legacy Twenty Twelve and Twenty Fourteen themes and some popular third-party themes, such as Neve, Hestia and Sydney. The second condition is that the server has a chosen .php file that the web server account can read. The advisory gives pearcmd.php as an example when register_argc_argv is on, and notes that the default cPanel configuration is affected with PHP older than 8.5.
You do not need to check the conditions one by one. If your version is below the fixed one for your branch, update.
What to do
- Update WordPress. Open
Dashboard > Updatesand clickUpdate Now, or update the site from WP Toolkit in cPanel. If the site receives automatic background updates, WordPress starts the update by itself, but check that it went through. - Check the version in
Tools > Site Health > Infoor withwp core version. It must be at least the fixed one for your branch. - If you are on an older branch, such as 6.8, there is a fix for it too. WordPress backported it as a courtesy to all branches down to 4.7 and reminds users that only the newest version is actively supported. Plan to move to it.
The advisory lists no workaround, so updating is the only way to close the flaw.
What we do
If you do not want to follow such releases yourself, with vulnerability (CVE) monitoring we match WordPress, the plugins and the themes on your site against vulnerability databases and tell you what to update before anyone exploits it, wherever the site is hosted. Write to us through the inquiry form if you want us to watch your site too.
Frequently asked questions
What is CVE-2026-87902?
A critical vulnerability in WordPress core, fixed in version 7.1.2 on 22 September 2026. Under certain conditions a person without an account on the site can make WordPress include a chosen PHP file from the server, which can lead to remote code execution. The security advisory rates it 9.2 on CVSS 4.0.
Which WordPress versions does CVE-2026-87902 affect?
All versions from 4.7.0 to 7.1.1. The fix is one version per branch, for example 7.1.2, 7.0.6, 6.9.9 and 6.8.10, and older branches have fixed versions down to 4.7.37. The full list is in the WordPress advisory.
How do I see my WordPress version?
In wp-admin open Tools > Site Health > Info and look at the WordPress section. In cPanel's Terminal, wp core version run in the site's folder only reads and returns the version number. It must be at least the fixed version for your branch.
Is CVE-2026-87902 already being exploited?
Yes. Patchstack reports the first attempts reaching its firewall at 11:49 UTC on 22 September 2026, the day WordPress 7.1.2 came out. In an update of 23 September the company also sees attempts to write PHP files to disk.
Which themes make a site vulnerable to CVE-2026-87902?
The first condition is that the active theme, child or parent, has a top-level folder whose name starts with page-, for example page-templates. According to the advisory this affects the legacy Twenty Twelve and Twenty Fourteen themes and some popular third-party themes such as Neve, Hestia and Sydney. If your version is below the fixed one, update rather than checking the conditions one by one.
Is a site on cPanel affected?
The second condition for CVE-2026-87902 is a .php file on the server that the web server account can read. The advisory gives pearcmd.php as an example when register_argc_argv is on, and notes that the default cPanel configuration is affected with PHP older than 8.5.
Is there a workaround if I cannot update WordPress?
No. The advisory for CVE-2026-87902 lists no workaround, so updating is the only way to close the hole. Update from Dashboard > Updates with Update Now, or through WP Toolkit in cPanel.
Is there a fix for older branches such as WordPress 6.8?
Yes. WordPress backported the fix as a courtesy to every branch down to 4.7, so for 6.8 the version is 6.8.10. WordPress reminds users that only the newest version is actively supported, so plan the move to it.