WordPress released version 7.1.2 to fix CVE-2026-87902, a critical path traversal flaw in get_page_template() that could let an unauthenticated attacker load an arbitrary PHP file from outside the active theme directory. Under certain server and theme conditions, this could lead to remote code execution, so WordPress recommends updating immediately. #WordPress #CVE-2026-87902
Keypoints
- WordPress 7.1.2 fixes a critical security flaw.
- CVE-2026-87902 affects versions 4.7.0 through 7.1.1.
- The bug is in the get_page_template() function.
- An unauthenticated attacker can trigger path traversal to load a PHP file.
- The issue may lead to code execution and should be patched immediately.
Read More: https://www.helpnetsecurity.com/2026/09/23/cve-2026-87902-wordpress-7-1-2-security-release/