WordPress: unauthenticated path traversal in the core (CVE-2026-87902)

On 22 September 2026 WordPress released version 7.1.2, which fixes a critical unauthenticated path traversal vulnerability, CVE-2026-87902. The flaw is in the get_page_template() function in wp-includes/template.php and, according to the sources, dates back to version 4.7 of December 2016.

The flaw allows a remote attacker, without credentials, to include a readable PHP file outside the active theme directories. Code execution is not automatic: it depends on server and theme configuration, which the sources describe in different ways. The real risk must therefore be assessed on your own environment, not assumed in the abstract.

The severity is reported with different values: 9.2 with CVSS v4.0 according to Safe Security, 8.1 out of 10 according to TechRadar. On one point the sources agree: according to SecurityWeek, exploitation attempts began within hours of disclosure.

The fixes are in release 7.1.2 and in backports for older branches: 7.0.6 and 6.9.9, and down to 4.7.37 according to Drweb. The core update alone does not close the risk if the active theme is vulnerable or outdated.

Update WordPress to the fixed branch, check the active theme and review the logs for anomalous requests to theme paths. For the PHP configuration to verify, follow the official advisory.