WordPress — Critical Local File Inclusion (LFI) to RCE Vulnerability in Core (CVE-2026-87902)

Publication date: September 22, 2026
Category: Vulnerability / Web Security

Introduction

The WordPress project has issued an emergency security patch to address a critical vulnerability residing within its core software, officially tracked as CVE-2026-87902. The flaw allows an unauthenticated attacker—requiring zero user accounts or prior privileges—to trigger the loading of PHP files located outside the active theme directories of a targeted website. Disclosed privately by security researcher Robert Ressl via the HackerOne bug bounty program, this routing defect exposes a vast ecosystem of deployments worldwide, impacting every maintained development branch ranging from version 4.7.0 up to 7.1.1.

What is CVE-2026-87902? (General Analysis)

The vulnerability designated as CVE-2026-87902 is a Local File Inclusion (LFI) flaw rooted in the page-template resolution logic of the WordPress core, specifically within the get_page_template() function.

• Official CVSS v3.1 Score and Vector: 8.1 (HIGH) — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (Official NVD verified data).
• Official CWE Classification: CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program (“PHP Remote File Inclusion”) (Official NVD verified data).
• CISA KEV Catalog: Not listed in the Known Exploited Vulnerabilities catalog as of publication.

The affected component is the subsystem responsible for determining which template file renders a requested page in the browser. Due to inadequate validation of components extracted from web request URLs, the application processes string values that can facilitate directory traversal outside permitted boundaries, resulting in the inclusion and execution of readable .php files present on the underlying server.

How Does It Work? (Technical Analysis)

The attack vector operates by exploiting inadequate input sanitization within the WordPress template resolution workflow.

• Input Flow and Validation Defect: The resolution mechanism constructs filenames by leveraging parts of the incoming web address. In vulnerable versions, this input string was not rigorously filtered against directory traversal steps (../) using the checks already implemented in adjacent code blocks. Consequently, the parameter is concatenated into a page-{value}.php structure.
• Theme-Specific Preconditions: For the constructed filename attack to succeed successfully, the site’s active theme must feature a top-level directory whose name begins with the prefix page-, and the target file must conclude with the .php extension. While current default themes omit this pattern, several legacy or third-party themes do utilize matching directory layouts.
• Transition from LFI to Remote Code Execution (RCE): The initial loading of a local PHP file executes its static contents natively. However, transforming this behavior into attacker-controlled arbitrary code execution mandates a secondary server-side condition: the application must run with the register_argc_argv PHP configuration setting enabled. This directive enables HTTP requests to feed command-line arguments into scripts, a known vector utilized to execute malicious payloads under the privileges of the web server account (such as www-data).

Affected Systems / Environments

The vulnerability impacts multiple historical and modern core branches of WordPress, affecting any installation that has failed to apply the dedicated branch patch.

• Risk Profiles: Websites running legacy or custom themes featuring top-level directories starting with page-, hosted on servers where PHP maintains outdated default configurations with register_argc_argv enabled.

Mitigation and Detection

Remediation

• Immediate Core Update: The definitive and most robust mitigation is applying the core software update. Administrators must update immediately to the designated version matching their deployment branch (e.g., users on branch 7.1.x must upgrade to 7.1.2).
• Environmental Hardening: For systems unable to patch immediately, operators can reduce exploitation pathways by disabling the register_argc_argv directive inside the PHP configuration file (php.ini) and removing unused PEAR components.

Detection

Defensive security teams should inspect web server access and error logs for anomalous HTTP requests attempting template path manipulation and directory traversal sequences.

Defensive Intelligence Note: HTTP requests directed toward template resolution endpoints that incorporate directory traversal traversal tokens (../) combined with theme folder prefixes should be flagged as active exploitation attempts targeting CVE-2026-87902.

• Server Log Monitoring (SIEM / Grep Analytics Example):
  bash Copy

  # Scanning HTTP access logs for path traversal patterns tied to template resolution
  cat /var/log/apache2/access.log | grep -E "page-.*\.php" | grep "\.\./"

Wrapping Up

The disclosure and rapid remediation of CVE-2026-87902 highlight the underlying complexities of maintaining legacy logic components within mature content management systems like WordPress. While transforming this LFI flaw into remote code execution requires strict environmental prerequisites — such as an enabled register_argc_argv directive and specific theme layouts — the absence of any authentication requirement elevates immediate patching to a critical operational priority for web administrators and security analysts globally.

References

• The Hacker News. (2026, September 22). WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers. The Hacker News
• WordPress.org. (2026, September 22). WordPress 7.1.2 Security Release. WordPress News
• WordPress Developers. (2026). GitHub Security Advisory: GHSA-7hp8-65ch-5whp (CVE-2026-87902). GitHub Advisories
• WordPress.org. (2026). Documentation: WordPress Version 7.1.2 Release Notes. WordPress Documentation
• Patchstack. (2026). WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE Analysis. Patchstack Research
• Ressl, R. (2026). Technical Write-up and Analysis of CVE-2026-87902 in WordPress. Ressl.ch Blog