WordPress 7.1.2 fixes a critical template-resolution flaw exploited for code execution
On September 22, 2026, WordPress shipped version 7.1.2 to fix CVE-2026-87902, a critical flaw that lets an unauthenticated attacker include a chosen local PHP file during page-template resolution and, under certain conditions, execute code. Update immediately, especially sites without automatic updates.
September 22, 2026. WordPress ships version 7.1.2, a security release targeting a single critical flaw. September 23, 2026. BleepingComputer reports that attackers have started exploiting the flaw for code execution. The blast radius is enormous: WordPress powers a major share of the web, and the flaw reaches back to its oldest branches. Why it matters: remote code execution in WordPress core is a rare event — and this one happens without authentication.
A flaw in template resolution, not in a plugin
CVE-2026-87902 (advisory GHSA-7hp8-65ch-5whp) sits in the get_page_template() function, at the heart of WordPress’s template resolution. Concretely, an unauthenticated attacker can, under certain conditions, make page-template resolution include a readable local PHP file of their choosing, located outside the active theme’s directories.
The “under certain conditions” is not rhetorical filler. Exploitation requires that the server environment and the active theme both meet specific preconditions. Not every site is equally exposed — but when the conditions line up, the outcome is remote code execution.
The researcher credited is Robert Ressl, who disclosed the flaw responsibly. The WordPress security team thanks him by name in the release notes — a rare signal, reserved for disclosures that avert a disaster.
Why this is worse than a typical plugin flaw
A plugin flaw hits the sites that use it. A core flaw hits everyone, or nearly. The difference in treatment is immediate: WordPress backported the fix to every branch eligible for security fixes, currently down to 4.7. That is the most reliable indicator of real severity — you do not backport a fix to releases more than a decade old for a trivial bug.
The second signal is the ClassicPress fork, derived from WordPress, which is also affected — but for which no security update has been provided yet. ClassicPress users are in a tight spot: the flaw is public, the fix is not.
The third signal is exploitation. BleepingComputer reported on September 23 that attackers have begun exploiting the critical flaw for code execution. The window between disclosure and exploitation, already shrinking on network devices, is now closing on the world’s most widespread CMS.
What you should do
The instruction is simple because WordPress’s update mechanism is simple. Update to 7.1.2 immediately. The fix is available from WordPress.org or from the dashboard, via “Updates” and then “Update Now.” Sites that support automatic background updates will receive the update without intervention.
# WP-CLI: check the installed version, then trigger the core update
wp core version
wp core update --version=7.1.2
# Confirm nothing is left pending afterwards
wp core updateVersion 7.1.2 is a pure security release with a single fix, which makes it low-risk to deploy: no feature changes, no theme or plugin churn. That is the ideal candidate for a same-day rollout across a fleet — the only sites that should hesitate are those with custom code that a core update might expose.
The real concern is not up-to-date sites, but frozen ones: installs where automatic updates are disabled, themes or plugins that block the mechanism, or environments maintained offline. For those, the manual update is the only protection — and it can no longer wait, since exploitation has already begun.
For ClassicPress sites, the situation is inverted: with no published fix, the response is to track the fork’s announcement closely and, in the meantime, harden the server environment — restrict PHP execution, limit the files readable by the web account, and monitor access logs for anomalous requests to template paths.
A precedent clarifies what may come next. In July 2026, version 7.0.2 fixed one critical and one high-severity flaw, and the WordPress.org team enabled forced updates through the auto-update system for sites on affected versions — a rare measure, reserved for flaws severe enough to override an administrator’s preference. So far, 7.1.2 has not triggered the same mechanism. The responsibility therefore falls back on administrators whose auto-update is disabled: those are the sites the ongoing exploitation will concentrate on.
How template resolution opens the door
To understand the flaw, you have to know how WordPress picks the file that renders a page. When a request arrives, the engine walks a template hierarchy: it looks first for a file specific to the content type, then climbs toward more generic fallbacks. get_page_template() is the function that decides which PHP file of the active theme will run for a given page.
The flaw breaks a basic assumption: that this resolution stays confined to the theme’s directories. An attacker can make the resolution point to a readable local PHP file elsewhere — a configuration file, a plugin, or any other file the web account can read. If that file contains executable code, it gets interpreted by PHP. The result, when the server and theme conditions align, is remote code execution.
Concretely, the most exposed sites are those where the web account — often www-data — can read PHP files outside the theme, a common setup on shared hosting where permissions are permissive, or on installs that store sensitive files in reachable locations. A theme that declares custom templates widens the surface too: it supplies the paths that resolution may end up following.
A “critical” severity does not mean “trivial exploitation on every site.” It reflects the worst case: a site that meets the preconditions loses control with no authentication required. That is exactly the risk profile the backport down to 4.7 is meant to cover.
Detecting exploitation that is already underway
For sites that cannot update immediately, detection works on two fronts. First, files: a code execution often leaves a PHP file added or modified, typically in wp-content/uploads or in the theme directory. Second, logs: requests to unusual template paths, or repeated calls to files outside the expected directories.
# Find PHP files modified recently in the WordPress tree
find /var/www -name "*.php" -mtime -7 -type f 2>/dev/null
# Spot PHP files dropped into upload directories (never legitimate)
find wp-content/uploads -name "*.php" 2>/dev/nullThe second signal is an unexpected PHP file in a directory that should contain none — the most common marker of a dropped webshell. The rule of thumb holds everywhere: a fast update beats fine detection, but when the update is impossible, detection is the only net you have.
Verdict
CVE-2026-87902 is a reminder that WordPress core is not immune to RCE, just less often hit. If you run a WordPress site, update to 7.1.2 — a few minutes of work against a potential code execution. If you run a fleet, prioritize the sites with automatic updates disabled, because those are what the ongoing exploitation will target first. If you are on ClassicPress, you are exposed without a fix: follow the fork’s announcement and harden the environment in the meantime.